Browse Source

strscpy: zero any trailing garbage bytes in the destination

It's possible that the destination can be shadowed in userspace
(as, for example, the perf buffers are now).  So we should take
care not to leak data that could be inspected by userspace.

Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
Chris Metcalf 10 năm trước cách đây
mục cha
commit
990486c8af
1 tập tin đã thay đổi với 2 bổ sung1 xóa
  1. 2 1
      lib/string.c

+ 2 - 1
lib/string.c

@@ -203,12 +203,13 @@ ssize_t strscpy(char *dest, const char *src, size_t count)
 		unsigned long c, data;
 		unsigned long c, data;
 
 
 		c = *(unsigned long *)(src+res);
 		c = *(unsigned long *)(src+res);
-		*(unsigned long *)(dest+res) = c;
 		if (has_zero(c, &data, &constants)) {
 		if (has_zero(c, &data, &constants)) {
 			data = prep_zero_mask(c, data, &constants);
 			data = prep_zero_mask(c, data, &constants);
 			data = create_zero_mask(data);
 			data = create_zero_mask(data);
+			*(unsigned long *)(dest+res) = c & zero_bytemask(data);
 			return res + find_zero(data);
 			return res + find_zero(data);
 		}
 		}
+		*(unsigned long *)(dest+res) = c;
 		res += sizeof(unsigned long);
 		res += sizeof(unsigned long);
 		count -= sizeof(unsigned long);
 		count -= sizeof(unsigned long);
 		max -= sizeof(unsigned long);
 		max -= sizeof(unsigned long);