Commit 072af0c6 authored by Kees Cook's avatar Kees Cook
Browse files

fortify: Fix dropped strcpy() compile-time write overflow check 



The implementation for intra-object overflow in str*-family functions
accidentally dropped compile-time write overflow checking in strcpy(),
leaving it entirely to run-time. Add back the intended check.

Fixes: 6a39e62a ("lib: string.h: detect intra-object overflow in fortified string functions")
Cc: Daniel Axtens <dja@axtens.net>
Cc: Francis Laniel <laniel_francis@privacyrequired.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
parent a52f8a59

include/linux/fortify-string.h

+4 −1
Original line number Diff line number Diff line
@@ -287,7 +287,10 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q) 
	if (p_size == (size_t)-1 && q_size == (size_t)-1)

		return __underlying_strcpy(p, q);

	size = strlen(q) + 1;

	/* test here to use the more stringent object size */

	/* Compile-time check for const size overflow. */

	if (__builtin_constant_p(size) && p_size < size)

		__write_overflow();

	/* Run-time check for dynamic size overflow. */

	if (p_size < size)

		fortify_panic(__func__);

	memcpy(p, q, size);