diff options
| author | Kees Cook <keescook@chromium.org> | 2021-08-02 10:25:01 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-11-18 19:16:25 +0100 |
| commit | 80adbd8c450235c6618311103ab578190a80bfd0 (patch) | |
| tree | 86548a675fbb221b88d4bfe9d00e22c786990b8e /include | |
| parent | c9f95c678318e47be6c0981c305b39d0276e687c (diff) | |
| download | linux-80adbd8c450235c6618311103ab578190a80bfd0.tar.gz linux-80adbd8c450235c6618311103ab578190a80bfd0.tar.bz2 linux-80adbd8c450235c6618311103ab578190a80bfd0.zip | |
fortify: Fix dropped strcpy() compile-time write overflow check
[ Upstream commit 072af0c638dc8a5c7db2edc4dddbd6d44bee3bdb ]
The implementation for intra-object overflow in str*-family functions
accidentally dropped compile-time write overflow checking in strcpy(),
leaving it entirely to run-time. Add back the intended check.
Fixes: 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified string functions")
Cc: Daniel Axtens <dja@axtens.net>
Cc: Francis Laniel <laniel_francis@privacyrequired.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/fortify-string.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h index c1be37437e77..0c70febd03e9 100644 --- a/include/linux/fortify-string.h +++ b/include/linux/fortify-string.h @@ -280,7 +280,10 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q) if (p_size == (size_t)-1 && q_size == (size_t)-1) return __underlying_strcpy(p, q); size = strlen(q) + 1; - /* test here to use the more stringent object size */ + /* Compile-time check for const size overflow. */ + if (__builtin_constant_p(size) && p_size < size) + __write_overflow(); + /* Run-time check for dynamic size overflow. */ if (p_size < size) fortify_panic(__func__); memcpy(p, q, size); |