[PATCH] Remove hardcoded static string length
Jeffrey E Altman
jaltman at auristor.com
Sat May 27 07:45:10 PDT 2023
On 5/24/2023 1:43 PM, Andrew Lunn wrote:
> On Wed, May 24, 2023 at 01:02:36PM -0400, Kenny Ho wrote:
>> On Wed, May 24, 2023 at 12:02 PM Andrew Lunn <andrew at lunn.ch> wrote:
>>> So the compiler warning/error needs to be fixed a different want.
>> Understood. Would caping the length at iov_len with a ternary be sufficient?
> The quoted text said 'string'. It is not clear if that means c-string,
> with a trailing \0. If you just cap iov_len you could end up with a
> string which is not terminated.
The expected buffer is a NUL terminated c-string.
> The other end of the socket should not blow up, because that would be
> an obvious DOS or buffer overwrite attack vector.
This is a valid concern because all versions of IBM AFS 3.6 Rx and
OpenAFS Rx prior to 1.6.23 are susceptible to read beyond the end of
buffer if either the received data is longer than 65 octets or the
received data is 65 octets but not NUL terminated.
Jeffrey Altman
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4039 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.infradead.org/pipermail/linux-afs/attachments/20230527/525fdb7a/attachment-0001.p7s>
More information about the linux-afs
mailing list