From owner-cvs-src@FreeBSD.ORG Sat Jan 31 14:50:21 2004 Return-Path: Delivered-To: cvs-src@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4CF3516A4CE; Sat, 31 Jan 2004 14:50:21 -0800 (PST) Received: from odin.ac.hmc.edu (Odin.AC.HMC.Edu [134.173.32.75]) by mx1.FreeBSD.org (Postfix) with ESMTP id B1B2043D31; Sat, 31 Jan 2004 14:50:19 -0800 (PST) (envelope-from brdavis@odin.ac.hmc.edu) Received: from odin.ac.hmc.edu (IDENT:brdavis@localhost.localdomain [127.0.0.1]) by odin.ac.hmc.edu (8.12.10/8.12.3) with ESMTP id i0VMoE2h011018; Sat, 31 Jan 2004 14:50:14 -0800 Received: (from brdavis@localhost) by odin.ac.hmc.edu (8.12.10/8.12.3/Submit) id i0VMoEhe011017; Sat, 31 Jan 2004 14:50:14 -0800 Date: Sat, 31 Jan 2004 14:50:14 -0800 From: Brooks Davis To: Peter Jeremy Message-ID: <20040131225013.GA14981@Odin.AC.HMC.Edu> References: <200401270143.i0R1hEIO011023@repoman.freebsd.org> <20040129133342.GC19899@FreeBSD.org.ua> <20040131201747.GO908@cirb503493.alcatel.com.au> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="WIyZ46R2i8wDzkSu" Content-Disposition: inline In-Reply-To: <20040131201747.GO908@cirb503493.alcatel.com.au> User-Agent: Mutt/1.5.4i X-Virus-Scanned: by amavisd-milter (http://amavis.org/) on odin.ac.hmc.edu cc: cvs-src@freebsd.org cc: Brooks Davis cc: src-committers@freebsd.org cc: cvs-all@freebsd.org Subject: Re: cvs commit: src/sbin/ifconfig ifconfig.c ifconfig.h X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Jan 2004 22:50:21 -0000 --WIyZ46R2i8wDzkSu Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Feb 01, 2004 at 07:17:48AM +1100, Peter Jeremy wrote: > On Mon, Jan 26, 2004 at 05:43:14PM -0800, Brooks Davis wrote: > > brooks 2004/01/26 17:43:14 PST > >=20 > > FreeBSD src repository > >=20 > > Modified files: > > sbin/ifconfig ifconfig.c ifconfig.h=20 > > Log: > > Use IFNAMSIZ instead of a magic value for the length of an interface > > name. > > =20 > > Prevent the kernel from potentially overflowing the interface name > > variable. The size argument of strlcpy is complex because the name is > > not null-terminated in sdl_data. >=20 > Based on this comment and a quick look at the code change, I don't believe > this change is correct. The source argument to strlcpy(3) _must_ be NUL > terminated - although strlcpy() will only copy the specified number of > characters, it will traverse the source argument until it finds a NUL > character so it can return the size of the source argument. In this case, > sdl_data is not intentionally NUL terminated so the strlcpy() can scan > forward over an arbitrary amount of process address space until stopped > by a random NUL, SIGBUS or SIGSEGV. The latter two possibilities are > undesirable :-). >=20 > In this case, I believe the correct code is something like: > memcpy(name, sdl->sdl_data, sizeof(name) < sdl->sdl_nlen ? > sizeof(name)-1 : sdl->sdl_nlen); > name[sizeof(name) < sdl->sdl_nlen ? sizeof(name)-1 : sdl->sdl_nlen] > =3D '\0'; > (strncpy could be used in place of memcpy). You are correct. I forgot about that issue. I'll commit this fix soon. On the plus side, this won't actually happen with real interfaces because the minimum size of sdl_data is larger then is actually needed by any interface I've found so in practice you will hit a NUL after the address. -- Brooks --=20 Any statement of the form "X is the one, true Y" is FALSE. PGP fingerprint 655D 519C 26A7 82E7 2529 9BF0 5D8E 8BE9 F238 1AD4 --WIyZ46R2i8wDzkSu Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFAHDElXY6L6fI4GtQRAiTjAJ9YKF8St+/XpXHlxtxqquMC/4ji2gCgkTN3 D+eMdAq7KF0sNAseXZabu4Y= =eEUH -----END PGP SIGNATURE----- --WIyZ46R2i8wDzkSu--