• K
    ray_cs: Avoid reading past end of buffer · e48d661e
    Kees Cook 提交于
    Using memcpy() from a buffer that is shorter than the length copied means
    the destination buffer is being filled with arbitrary data from the kernel
    rodata segment. In this case, the source was made longer, since it did not
    match the destination structure size. Additionally removes a needless cast.
    
    This was found with the future CONFIG_FORTIFY_SOURCE feature.
    
    Cc: Daniel Micay <danielmicay@gmail.com>
    Signed-off-by: NKees Cook <keescook@chromium.org>
    Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
    e48d661e
ray_cs.c 85.2 KB