svn commit: r245036 - head/sys/kern

David Xu davidxu at FreeBSD.org
Fri Jan 4 11:11:13 UTC 2013


Author: davidxu
Date: Fri Jan  4 11:11:12 2013
New Revision: 245036
URL: http://svnweb.freebsd.org/changeset/base/245036

Log:
  Revert revision 244760 because strncpy pads trailing space with zero,
  this prevents kernel data from being leaked.
  
  Noticed by: Joerg Sonnenberger < joerg at britannica dot bec dot de >

Modified:
  head/sys/kern/vfs_mount.c

Modified: head/sys/kern/vfs_mount.c
==============================================================================
--- head/sys/kern/vfs_mount.c	Fri Jan  4 09:52:09 2013	(r245035)
+++ head/sys/kern/vfs_mount.c	Fri Jan  4 11:11:12 2013	(r245036)
@@ -559,7 +559,7 @@ vfs_donmount(struct thread *td, uint64_t
 	if (error || fstype[fstypelen - 1] != '\0') {
 		error = EINVAL;
 		if (errmsg != NULL)
-			strlcpy(errmsg, "Invalid fstype", errmsg_len);
+			strncpy(errmsg, "Invalid fstype", errmsg_len);
 		goto bail;
 	}
 	fspathlen = 0;
@@ -567,7 +567,7 @@ vfs_donmount(struct thread *td, uint64_t
 	if (error || fspath[fspathlen - 1] != '\0') {
 		error = EINVAL;
 		if (errmsg != NULL)
-			strlcpy(errmsg, "Invalid fspath", errmsg_len);
+			strncpy(errmsg, "Invalid fspath", errmsg_len);
 		goto bail;
 	}
 
@@ -1447,7 +1447,7 @@ vfs_filteropt(struct vfsoptlist *opts, c
 	if (ret != 0) {
 		TAILQ_FOREACH(opt, opts, link) {
 			if (strcmp(opt->name, "errmsg") == 0) {
-				strlcpy((char *)opt->value, errmsg, opt->len);
+				strncpy((char *)opt->value, errmsg, opt->len);
 				break;
 			}
 		}


More information about the svn-src-all mailing list