From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A159CDB47E for ; Thu, 19 Oct 2023 02:27:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232164AbjJSC1Z (ORCPT ); Wed, 18 Oct 2023 22:27:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35304 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229632AbjJSC1Y (ORCPT ); Wed, 18 Oct 2023 22:27:24 -0400 Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A288895 for ; Wed, 18 Oct 2023 19:27:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=bombadil.20210309; h=Content-Transfer-Encoding: Content-Type:In-Reply-To:From:References:Cc:To:Subject:MIME-Version:Date: Message-ID:Sender:Reply-To:Content-ID:Content-Description; bh=dxOjzErkh5+zOBFjAXg3fxhcdphmjj8jzIkYzk1WPo4=; b=lGaalIYZQEMesgAQnQaBGuUTdI 8sMhhoZrEZ9xoiO5fLnqAeov1dFW2FmOmGBE80ZEDqZZVr8xQgOABwZlbIW+pYAZLil7Q/AtN1gD3 ovYHjlg+y1YVoU2kkSjjOD6SD4cGKsO1C6jKTVfdA+rfPOh1FsgsTKdT+Ji8XAL1Ll97p3MFpcwF+ iBt8Vj9v/rxbxdKqxRxexGqK77JWiWVIUisuHDAwOOZnHvt/5VWwDdFG3EMhnnD8CeX2pH2GaZMWj HUx5p77cbKOK7nCgJ3O7JDaR9/Oot0Ltu0zGQZINulHVk1+nmVPV1d/tghI2CkvxSAveEnvDPwnNP w8dbYStw==; Received: from [50.53.46.231] (helo=[192.168.254.15]) by bombadil.infradead.org with esmtpsa (Exim 4.96 #2 (Red Hat Linux)) id 1qtIkr-00G8AZ-1G; Thu, 19 Oct 2023 02:27:21 +0000 Message-ID: Date: Wed, 18 Oct 2023 19:27:20 -0700 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: Is strncpy really less secure than strscpy ? To: Bagas Sanjaya , James Dutton , Linux Kernel Mailing List Cc: Justin Stitt , Calvince Otieno , Azeem Shaikh , Kees Cook , Andy Shevchenko References: Content-Language: en-US From: Randy Dunlap In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/18/23 18:49, Bagas Sanjaya wrote: > [Disclaimer: I have little to no knowledge of C, so things may be wrong. > Please correct me if it is the case. Also Cc: recent people who work on > strscpy() conversion.] > Also Cc: the STRING maintainers. > On Thu, Oct 19, 2023 at 12:22:33AM +0100, James Dutton wrote: >> Is strncpy really less secure than strscpy ? >> >> If one uses strncpy and thus put a limit on the buffer size during the >> copy, it is safe. There are no writes outside of the buffer. >> If one uses strscpy and thus put a limit on the buffer size during the >> copy, it is safe. There are no writes outside of the buffer. > > Well, assuming that the string is NUL-terminated, the end result should > be the same. > >> But, one can fit more characters in strncpy than strscpy because >> strscpy enforces the final \0 on the end. >> One could argue that strncpy is better because it might save the space >> of one char at the end of a string array. >> There are cases where strncpy might be unsafe. For example copying >> between arrays of different sizes, and that is a case where strscpy >> might be safer, but strncpy can be made safe if one ensures that the >> size used in strncpy is the smallest of the two different array sizes. > > Code example on both cases? > >> >> If one blindly replaces strncpy with strscpy across all uses, one >> could unintentionally be truncating the results and introduce new >> bugs. >> >> The real insecurity surely comes when one tries to use the string. >> For example: >> >> #include >> #include >> >> int main() { >> char a[10] = "HelloThere"; >> char b[10]; >> char c[10] = "Overflow"; >> strncpy(b, a, 10); >> /* This overflows and so in unsafe */ >> printf("a is %s\n", a); >> /* This overflows and so in unsafe */ >> printf("b is %s\n", b); >> /* This is safe */ >> printf("b is %.*s\n", 10, a); >> /* This is safe */ >> printf("b is %.*s\n", 4, a); >> return 0; >> } > > What if printf("a is %.*s\n", a);? > >> >> >> So, why isn't the printk format specifier "%.*s" used more instead of >> "%s" in the kernel? > > Since basically strings are pointers. > > Thanks. > -- ~Randy