Commit 311fb40a authored by Kees Cook's avatar Kees Cook
Browse files

fortify: Use SIZE_MAX instead of (size_t)-1 



Clean up uses of "(size_t)-1" in favor of SIZE_MAX.

Cc: linux-hardening@vger.kernel.org
Suggested-by: default avatarNick Desaulniers <ndesaulniers@google.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 875bfd52

include/linux/fortify-string.h

+15 −14
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
#define _LINUX_FORTIFY_STRING_H_



#include <linux/const.h>

#include <linux/limits.h>



#define __FORTIFY_INLINE extern __always_inline __gnu_inline __overloadable

#define __RENAME(x) __asm__(#x)
@@ -17,9 +18,9 @@ void __write_overflow_field(size_t avail, size_t wanted) __compiletime_warning(" 
#define __compiletime_strlen(p)					\

({								\

	unsigned char *__p = (unsigned char *)(p);		\

	size_t __ret = (size_t)-1;				\

	size_t __ret = SIZE_MAX;				\

	size_t __p_size = __builtin_object_size(p, 1);		\

	if (__p_size != (size_t)-1 &&				\

	if (__p_size != SIZE_MAX &&				\

	    __builtin_constant_p(*__p)) {			\

		size_t __p_len = __p_size - 1;			\

		if (__builtin_constant_p(__p[__p_len]) &&	\
@@ -127,7 +128,7 @@ char *strcat(char * const POS p, const char *q) 
{

	size_t p_size = __builtin_object_size(p, 1);



	if (p_size == (size_t)-1)

	if (p_size == SIZE_MAX)

		return __underlying_strcat(p, q);

	if (strlcat(p, q, p_size) >= p_size)

		fortify_panic(__func__);
@@ -142,7 +143,7 @@ __FORTIFY_INLINE __kernel_size_t strnlen(const char * const POS p, __kernel_size 
	size_t ret;



	/* We can take compile-time actions when maxlen is const. */

	if (__builtin_constant_p(maxlen) && p_len != (size_t)-1) {

	if (__builtin_constant_p(maxlen) && p_len != SIZE_MAX) {

		/* If p is const, we can use its compile-time-known len. */

		if (maxlen >= p_size)

			return p_len;
@@ -170,7 +171,7 @@ __kernel_size_t __fortify_strlen(const char * const POS p) 
	size_t p_size = __builtin_object_size(p, 1);



	/* Give up if we don't know how large p is. */

	if (p_size == (size_t)-1)

	if (p_size == SIZE_MAX)

		return __underlying_strlen(p);

	ret = strnlen(p, p_size);

	if (p_size <= ret)
@@ -187,7 +188,7 @@ __FORTIFY_INLINE size_t strlcpy(char * const POS p, const char * const POS q, si 
	size_t q_len;	/* Full count of source string length. */

	size_t len;	/* Count of characters going into destination. */



	if (p_size == (size_t)-1 && q_size == (size_t)-1)

	if (p_size == SIZE_MAX && q_size == SIZE_MAX)

		return __real_strlcpy(p, q, size);

	q_len = strlen(q);

	len = (q_len >= size) ? size - 1 : q_len;
@@ -215,7 +216,7 @@ __FORTIFY_INLINE ssize_t strscpy(char * const POS p, const char * const POS q, s 
	size_t q_size = __builtin_object_size(q, 1);



	/* If we cannot get size of p and q default to call strscpy. */

	if (p_size == (size_t) -1 && q_size == (size_t) -1)

	if (p_size == SIZE_MAX && q_size == SIZE_MAX)

		return __real_strscpy(p, q, size);



	/*
@@ -260,7 +261,7 @@ char *strncat(char * const POS p, const char * const POS q, __kernel_size_t coun 
	size_t p_size = __builtin_object_size(p, 1);

	size_t q_size = __builtin_object_size(q, 1);



	if (p_size == (size_t)-1 && q_size == (size_t)-1)

	if (p_size == SIZE_MAX && q_size == SIZE_MAX)

		return __underlying_strncat(p, q, count);

	p_len = strlen(p);

	copy_len = strnlen(q, count);
@@ -301,10 +302,10 @@ __FORTIFY_INLINE void fortify_memset_chk(__kernel_size_t size, 
	/*

	 * Always stop accesses beyond the struct that contains the

	 * field, when the buffer's remaining size is known.

	 * (The -1 test is to optimize away checks where the buffer

	 * (The SIZE_MAX test is to optimize away checks where the buffer

	 * lengths are unknown.)

	 */

	if (p_size != (size_t)(-1) && p_size < size)

	if (p_size != SIZE_MAX && p_size < size)

		fortify_panic("memset");

}
@@ -395,11 +396,11 @@ __FORTIFY_INLINE void fortify_memcpy_chk(__kernel_size_t size, 
	/*

	 * Always stop accesses beyond the struct that contains the

	 * field, when the buffer's remaining size is known.

	 * (The -1 test is to optimize away checks where the buffer

	 * (The SIZE_MAX test is to optimize away checks where the buffer

	 * lengths are unknown.)

	 */

	if ((p_size != (size_t)(-1) && p_size < size) ||

	    (q_size != (size_t)(-1) && q_size < size))

	if ((p_size != SIZE_MAX && p_size < size) ||

	    (q_size != SIZE_MAX && q_size < size))

		fortify_panic(func);

}
@@ -498,7 +499,7 @@ char *strcpy(char * const POS p, const char * const POS q) 
	size_t size;



	/* If neither buffer size is known, immediately give up. */

	if (p_size == (size_t)-1 && q_size == (size_t)-1)

	if (p_size == SIZE_MAX && q_size == SIZE_MAX)

		return __underlying_strcpy(p, q);

	size = strlen(q) + 1;

	/* Compile-time check for const size overflow. */