HomeFreeBSD

Fix intra-object buffer overread for labeled msdosfs volumes

Description

Fix intra-object buffer overread for labeled msdosfs volumes

Volume labels, like directory entries, are padded with spaces and so
have no NUL terminator. Whilst the MIN for the dsize argument to strlcpy
ensures that the copy does not overflow the destination, strlcpy is
defined to return the number of characters in the source string,
regardless of the provided dsize, and so keeps reading until it finds a
NUL, which likely exists somewhere within the following fields, but On
CHERI with the subobject bounds enabled in the compiler this buffer
overread will be detected and trap with a bounds violation.

Found by: CHERI
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D32579

Details

Provenance
jrtc27Authored on Oct 24 2021, 6:49 PM
Reviewer
imp
Differential Revision
D32579: Fix intra-object buffer overread for labeled msdosfs volumes
Parents
rGf350bc1dd368: ada: Fix intra-object buffer overread of identify strings
Branches
Unknown
Tags
Unknown