sysctl: don't overflow the user-supplied buffer with '\0'

If the string was too long to fit in the user-supplied buffer, the sysctl layer would zero-terminate it by writing past the end of the buffer. Don't do that. Noticed by Yi Yang <yang.y.yi@gmail.com>

Linus Torvalds committed 20 years ago

Commit 8febdd81 parent 8b90db01 file · +1 −3Browse files

Unified · Split

kernel/sysctl.c+1−3

@@ -2201,14 +2201,12 @@ int sysctl_string(ctl_table table, int __user name, int nlen, · 2200 unmodified lines
2201	2201	if (get_user(len, oldlenp))
2202	2202	return -EFAULT;
2203	2203	if (len) {
2204		− l = strlen(table->data);
	2204	+ l = strlen(table->data)+1;
2205	2205	if (len > l) len = l;
2206	2206	if (len >= table->maxlen)
2207	2207	len = table->maxlen;
2208	2208	if(copy_to_user(oldval, table->data, len))
2209	2209	return -EFAULT;
2210		− if(put_user(0, ((char __user *) oldval) + len))
2211		− return -EFAULT;
2212	2210	if(put_user(len, oldlenp))
2213	2211	return -EFAULT;
2214	2212	}