Google
  Web www.spinics.net

buffer overflow in srm_env_write?!

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


Shouldn't

	if (copy_from_user(buf, buffer, count))
		goto out;
	buf[count] = '\0';

	ret1 = callback_setenv(entry->id, buf, count);

read

	buf[count-1] = '\0';
          ^^^^^^^

in srm_env_write() in srm_env.c?! When I change SRM variables via
/proc/srm_environment, a trailing linefeed 0x0a is written into the
variable, which it is not when changing the variable via the SRM graphical
console itself. The above code change overwrites the linefeed with 0x0.

	Oliver


[Home]     [Fedora Users]     [Fedora Legacy List]     [Fedora Maintainers]     [Fedora Desktop]     [Red Hat 9 Bible]     [Fedora Bible]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]

Powered by Linux

Google
  Web www.spinics.net