Skip to content

Commit

Permalink
fortify: Fix dropped strcpy() compile-time write overflow check
Browse files Browse the repository at this point in the history
The implementation for intra-object overflow in str*-family functions
accidentally dropped compile-time write overflow checking in strcpy(),
leaving it entirely to run-time. Add back the intended check.

Fixes: 6a39e62 ("lib: string.h: detect intra-object overflow in fortified string functions")
Cc: Daniel Axtens <dja@axtens.net>
Cc: Francis Laniel <laniel_francis@privacyrequired.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
  • Loading branch information
kees committed Sep 25, 2021
1 parent a52f8a5 commit 072af0c
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion include/linux/fortify-string.h
Original file line number Diff line number Diff line change
Expand Up @@ -287,7 +287,10 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q)
if (p_size == (size_t)-1 && q_size == (size_t)-1)
return __underlying_strcpy(p, q);
size = strlen(q) + 1;
/* test here to use the more stringent object size */
/* Compile-time check for const size overflow. */
if (__builtin_constant_p(size) && p_size < size)
__write_overflow();
/* Run-time check for dynamic size overflow. */
if (p_size < size)
fortify_panic(__func__);
memcpy(p, q, size);
Expand Down

0 comments on commit 072af0c

Please sign in to comment.