Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unintended memory access when reading the label length? #341

Open
presto8 opened this issue Oct 12, 2024 · 0 comments
Open

Unintended memory access when reading the label length? #341

presto8 opened this issue Oct 12, 2024 · 0 comments

Comments

@presto8
Copy link

presto8 commented Oct 12, 2024

if (!strlen(sb->label))

In super-io.c, strlen() is used to determine whether a label is present. However, sb->label is not required to be null-terminated. If it is less than the maximum length, it will be null-terminated. But if it is the maximum length, then it will not be null-terminated, thus causing strlen() to keep reading until it encounters a null character, which will be reading into the other fields of the data structure and perhaps even read outside of the data structure?

I tried it on a filesystem with a 32-length label, and strlen() read 34 bytes and returned 33.

Would if (sb->label[0]) be safer? If the label is present, the first char will be non-zero. And if the label is not present, the first char will be null.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant