• Kees Cook's avatar
    ray_cs: Avoid reading past end of buffer · e48d661e
    Kees Cook authored
    Using memcpy() from a buffer that is shorter than the length copied means
    the destination buffer is being filled with arbitrary data from the kernel
    rodata segment. In this case, the source was made longer, since it did not
    match the destination structure size. Additionally removes a needless cast.
    
    This was found with the future CONFIG_FORTIFY_SOURCE feature.
    
    Cc: Daniel Micay <danielmicay@gmail.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    e48d661e
ray_cs.c 85.2 KB