Skip to content

Conversation

@songliang-47590
Copy link

The meaning of the "len" parameter in the my_strncat function is the size limit for copying characters from "from", not the size limit for "to" after copying.
Also, the "#define safestrcat(to, from) my_strncat(to, from, sizeof(to) - strlen(to) - 1)" has already imposed a limit on max based on the size of "to".
Modify the function to prevent truncation of content when too many bytes are passed to the my_strcat function.

The meaning of the "len" parameter in the my_strncat function is the size limit for copying characters from "from", not the size limit for "to" after copying.
Also, the "#define safestrcat(to, from) my_strncat(to, from, sizeof(to) - strlen(to) - 1)" has already imposed a limit on max based on the size of "to".
Modify the function to prevent truncation of content when too many bytes are passed to the my_strcat function.

Signed-off-by: songliang <[email protected]>
@hongxu-jia
Copy link

The bug was introduced by upstream commit [1] where strncat was replaced with
internal my_strncat function, such as:

char dest[32] = "/sys/devices/platform/axi";
my_strncat(dest, "/", sizeof(dest) - strlen(dest) - 1);

Will result in dest string being:

/sys/

and not the expected:

/sys/devices/platform/axi/

[1] 0719881

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants