Message ID | 20200422102808.9197-3-jhs@emojatatu.com |
---|---|
State | Changes Requested |
Delegated to: | stephen hemminger |
Headers | show |
Series | bpf: memory access fixes | expand |
Jamal Hadi Salim wrote on Wed, Apr 22, 2020: > sub = strtok(rem, "/"); > while (sub) { > - if (strlen(tmp) + strlen(sub) + 2 > PATH_MAX) > - return -EINVAL; > + if (strlen(tmp) + strlen(sub) + 2 > PATH_MAX) { > + ret = -EINVAL; > + goto out; > + } Now I'm looking at this we're a bit inconsistent with return values in this function, other error paths return negative value + errno set, and this only returns -errno. Digging a bit into callers it looks like errno is the way to go, so while you're modifying this it might be worth setting errno to EINVAL as well here? Cheers & sorry for nitpicking,
diff --git a/lib/bpf.c b/lib/bpf.c index 656cad02..fdcede1c 100644 --- a/lib/bpf.c +++ b/lib/bpf.c @@ -1523,13 +1523,15 @@ static int bpf_make_custom_path(const struct bpf_elf_ctx *ctx, ret = asprintf(&rem, "%s/", todo); if (ret < 0) { fprintf(stderr, "asprintf failed: %s\n", strerror(errno)); - goto out; + return ret; } sub = strtok(rem, "/"); while (sub) { - if (strlen(tmp) + strlen(sub) + 2 > PATH_MAX) - return -EINVAL; + if (strlen(tmp) + strlen(sub) + 2 > PATH_MAX) { + ret = -EINVAL; + goto out; + } strcat(tmp, sub); strcat(tmp, "/");