buffer overflow in srm_env_write?!
|[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]|
Shouldn't if (copy_from_user(buf, buffer, count)) goto out; buf[count] = '\0'; ret1 = callback_setenv(entry->id, buf, count); read buf[count-1] = '\0'; ^^^^^^^ in srm_env_write() in srm_env.c?! When I change SRM variables via /proc/srm_environment, a trailing linefeed 0x0a is written into the variable, which it is not when changing the variable via the SRM graphical console itself. The above code change overwrites the linefeed with 0x0. Oliver
[Home] [Fedora Users] [Fedora Legacy List] [Fedora Maintainers] [Fedora Desktop] [Red Hat 9 Bible] [Fedora Bible] [Fedora SELinux] [Big List of Linux Books] [Yosemite News] [Yosemite Photos] [KDE Users] [Fedora Tools]