Re: [PATCH 3/4] security/selinux: decrement sizeof size in strncmp

[Julia Lawall <julia@diku.dk>]

On Fri, 13 Nov 2009, James Morris wrote:

> On Thu, 12 Nov 2009, Casey Schaufler wrote:
> 
> > I strongly suggest that this is not what is wanted.
> >     strcmp(x,y)
> > and
> >     strncmp(x,y,sizeof(y))
> > 
> > are functionally equivalent and strcmp has a bad reputation in
> > the security community because it is associated with potential
> > buffer overrun issues.
> 
> Do you see potential for a buffer overrun in this case?
> 
> The strings being compared are "sysfs" and the name field of 'struct 
> file_system_type'.  The kernel code elsewhere assumes the latter string to 
> be a valid zero-terminated string, and we should, too.

The sizeof only helps for the zero-termination of y, ie "sysfs".  Is it 
possible for the 0 at the end of an explicit constant string to get 
overwritten?  If it were the strncmp would be helpful, because the number 
of characters to consider would be determined at compile time.  If there 
is some problem with the name field, the strncmp will look at least to the 
end of "sysfs", so the strncmp won't help to keep the character accesses 
within the valid characters of name.

julia