Commit b54aebd4 authored by Rae Moar's avatar Rae Moar Committed by John Johansen
Browse files

apparmor: fix use of strcpy in policy_unpack_test 

Replace the use of strcpy() in build_aa_ext_struct() in
policy_unpack_test.c with strscpy().

strscpy() is the safer method to use to ensure the buffer does not
overflow. This was found by kernel test robot:
https://lore.kernel.org/all/202301040348.NbfVsXO0-lkp@intel.com/

.

Reported-by: default avatarkernel test robot <lkp@intel.com>

Signed-off-by: default avatarRae Moar <rmoar@google.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 76862af5

security/apparmor/policy_unpack_test.c

+6 −7
Original line number Diff line number Diff line
@@ -69,31 +69,30 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, 


	*buf = AA_NAME;

	*(buf + 1) = strlen(TEST_STRING_NAME) + 1;

	strcpy(buf + 3, TEST_STRING_NAME);

	strscpy(buf + 3, TEST_STRING_NAME, e->end - (void *)(buf + 3));



	buf = e->start + TEST_STRING_BUF_OFFSET;

	*buf = AA_STRING;

	*(buf + 1) = strlen(TEST_STRING_DATA) + 1;

	strcpy(buf + 3, TEST_STRING_DATA);



	strscpy(buf + 3, TEST_STRING_DATA, e->end - (void *)(buf + 3));

	buf = e->start + TEST_NAMED_U32_BUF_OFFSET;

	*buf = AA_NAME;

	*(buf + 1) = strlen(TEST_U32_NAME) + 1;

	strcpy(buf + 3, TEST_U32_NAME);

	strscpy(buf + 3, TEST_U32_NAME, e->end - (void *)(buf + 3));

	*(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32;

	*((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA;



	buf = e->start + TEST_NAMED_U64_BUF_OFFSET;

	*buf = AA_NAME;

	*(buf + 1) = strlen(TEST_U64_NAME) + 1;

	strcpy(buf + 3, TEST_U64_NAME);

	strscpy(buf + 3, TEST_U64_NAME, e->end - (void *)(buf + 3));

	*(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64;

	*((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA;



	buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET;

	*buf = AA_NAME;

	*(buf + 1) = strlen(TEST_BLOB_NAME) + 1;

	strcpy(buf + 3, TEST_BLOB_NAME);

	strscpy(buf + 3, TEST_BLOB_NAME, e->end - (void *)(buf + 3));

	*(buf + 3 + strlen(TEST_BLOB_NAME) + 1) = AA_BLOB;

	*(buf + 3 + strlen(TEST_BLOB_NAME) + 2) = TEST_BLOB_DATA_SIZE;

	memcpy(buf + 3 + strlen(TEST_BLOB_NAME) + 6,
@@ -102,7 +101,7 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, 
	buf = e->start + TEST_NAMED_ARRAY_BUF_OFFSET;

	*buf = AA_NAME;

	*(buf + 1) = strlen(TEST_ARRAY_NAME) + 1;

	strcpy(buf + 3, TEST_ARRAY_NAME);

	strscpy(buf + 3, TEST_ARRAY_NAME, e->end - (void *)(buf + 3));

	*(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY;

	*((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE;