[PATCH] libfile: null-terminate buffer as expected

[PATCH] libfile: null-terminate buffer as expected

[Ahmad Fatoum]

strim calls strlen on buf internally which is undefined because buf
is not null-terminated. Fix this.

Accessing buf+size is safe, because read_file_2 always allocates a
1 byte bigger buffer than the required (non-null-terminated) size.

This leading to errors can be observed by increasing the alignment of
the buffer allocated in read_file_2. This would lead to

	ERROR: Cannot init param from global: ... : Invalid argument

messages whenever nvvar_load is executed.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 lib/libfile.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/libfile.c b/lib/libfile.c
index 172602377fc0..92f8fc2608e5 100644
--- a/lib/libfile.c
+++ b/lib/libfile.c
@@ -136,6 +136,8 @@ char *read_file_line(const char *fmt, ...)
 	if (!buf)
 		goto out;
 
+	buf[size] = '\0';
+
 	line = strim(buf);
 
 	line = xstrdup(line);
-- 
2.23.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: [PATCH] libfile: null-terminate buffer as expected

[Ahmad Fatoum]

On 9/16/19 8:38 PM, Ahmad Fatoum wrote:
> strim calls strlen on buf internally which is undefined because buf
> is not null-terminated. Fix this.

Please dismiss... read_file_2 has its buffer allocated with calloc,
thus nothing to see here...

> 
> Accessing buf+size is safe, because read_file_2 always allocates a
> 1 byte bigger buffer than the required (non-null-terminated) size.
> 
> This leading to errors can be observed by increasing the alignment of
> the buffer allocated in read_file_2. This would lead to
> 
> 	ERROR: Cannot init param from global: ... : Invalid argument
> 
> messages whenever nvvar_load is executed.
> 
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
>  lib/libfile.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/lib/libfile.c b/lib/libfile.c
> index 172602377fc0..92f8fc2608e5 100644
> --- a/lib/libfile.c
> +++ b/lib/libfile.c
> @@ -136,6 +136,8 @@ char *read_file_line(const char *fmt, ...)
>  	if (!buf)
>  		goto out;
>  
> +	buf[size] = '\0';
> +
>  	line = strim(buf);
>  
>  	line = xstrdup(line);
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: [PATCH] libfile: null-terminate buffer as expected

[Sascha Hauer]

On Mon, Sep 16, 2019 at 08:48:13PM +0200, Ahmad Fatoum wrote:
> On 9/16/19 8:38 PM, Ahmad Fatoum wrote:
> > strim calls strlen on buf internally which is undefined because buf
> > is not null-terminated. Fix this.
> 
> Please dismiss... read_file_2 has its buffer allocated with calloc,
> thus nothing to see here...

except this:

---------------------------8<-------------------------------

From b3692899dd20e85368aea114f0984cf204f24356 Mon Sep 17 00:00:00 2001
From: Sascha Hauer <s.hauer@pengutronix.de>
Date: Tue, 17 Sep 2019 09:46:46 +0200
Subject: [PATCH] libfile: Document that read_file() returns a terminated
 buffer

read_file() and read_file_2() return a '\0' terminated buffer to make
sure the buffer is usable as a string. Other code like read_file_line()
depends on this behaviour, so document it explicitly.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 lib/libfile.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/libfile.c b/lib/libfile.c
index 172602377f..648d409a01 100644
--- a/lib/libfile.c
+++ b/lib/libfile.c
@@ -158,7 +158,9 @@ EXPORT_SYMBOL_GPL(read_file_line);
  * bytes are read. The actual read size is returned in @size. -EFBIG is
  * returned if the file is bigger than @max_size, but the buffer is read
  * anyway up to @max_size in this case. Free the buffer with free() after
- * usage.
+ * usage. The allocated buffer is actually one byte bigger than the file
+ * and the extra byte is initialized to '\0' so that the returned buffer
+ * can safely be interpreted as a string.
  *
  * Return: 0 for success, or negative error code. -EFBIG is returned
  * when the file has been bigger than max_size.
-- 
2.23.0

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox