diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-05-29 09:11:28 -0400 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2018-05-31 10:13:24 -0400 |
| commit | a41d80acfa2764e9b1ce49aa303a263e609d91f7 (patch) | |
| tree | 245f661c84f72a7f4dcb787f798c771971ac79ea | |
| parent | 72acd64df4561593d2ec3227b4aca9b0d7ded50e (diff) | |
EVM: prevent array underflow in evm_write_xattrs()
If the user sets xattr->name[0] to NUL then we would read one character
before the start of the array. This bug seems harmless as far as I can
see but perhaps it would trigger a warning in KASAN.
Fixes: fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
| -rw-r--r-- | security/integrity/evm/evm_secfs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c index cf5cd303d7c0..3cefef3919e5 100644 --- a/security/integrity/evm/evm_secfs.c +++ b/security/integrity/evm/evm_secfs.c | |||
| @@ -209,7 +209,7 @@ static ssize_t evm_write_xattrs(struct file *file, const char __user *buf, | |||
| 209 | 209 | ||
| 210 | /* Remove any trailing newline */ | 210 | /* Remove any trailing newline */ |
| 211 | len = strlen(xattr->name); | 211 | len = strlen(xattr->name); |
| 212 | if (xattr->name[len-1] == '\n') | 212 | if (len && xattr->name[len-1] == '\n') |
| 213 | xattr->name[len-1] = '\0'; | 213 | xattr->name[len-1] = '\0'; |
| 214 | 214 | ||
| 215 | if (strcmp(xattr->name, ".") == 0) { | 215 | if (strcmp(xattr->name, ".") == 0) { |