Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755636AbZKQRNb (ORCPT ); Tue, 17 Nov 2009 12:13:31 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753143AbZKQRNb (ORCPT ); Tue, 17 Nov 2009 12:13:31 -0500 Received: from metis.ext.pengutronix.de ([92.198.50.35]:51357 "EHLO metis.ext.pengutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752308AbZKQRNa (ORCPT ); Tue, 17 Nov 2009 12:13:30 -0500 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= To: linux-kernel@vger.kernel.org Cc: Michael Buesch , Peter Zijlstra , Andrew Morton , Linus Torvalds Subject: [PATCH] strcmp: fix overflow error Date: Tue, 17 Nov 2009 17:51:40 +0100 Message-Id: <1258476700-21323-1-git-send-email-u.kleine-koenig@pengutronix.de> X-Mailer: git-send-email 1.6.5.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SA-Exim-Connect-IP: 2001:6f8:1178:2:215:17ff:fe12:23b0 X-SA-Exim-Mail-From: ukl@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-kernel@vger.kernel.org Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1544 Lines: 56 strcmp("\x01", "\xef") returns 18 but it should return something < 0. The reason is that the variable holding the result of the subtraction is too small and overflows. As strcmp is e.g. used to access data in squashfs this might result in not finding files. The same problem is fixed in strncmp. Signed-off-by: Uwe Kleine-König Cc: Michael Buesch Cc: Peter Zijlstra Cc: Andrew Morton Cc: Linus Torvalds --- Hello, I didn't hit this problem in the wild, only when checking for something else. Is this stable material anyhow? Best regards Uwe lib/string.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/string.c b/lib/string.c index b19b87a..661ff06 100644 --- a/lib/string.c +++ b/lib/string.c @@ -246,7 +246,7 @@ EXPORT_SYMBOL(strlcat); #undef strcmp int strcmp(const char *cs, const char *ct) { - signed char __res; + int __res; while (1) { if ((__res = *cs - *ct++) != 0 || !*cs++) @@ -266,7 +266,7 @@ EXPORT_SYMBOL(strcmp); */ int strncmp(const char *cs, const char *ct, size_t count) { - signed char __res = 0; + int __res = 0; while (count) { if ((__res = *cs - *ct++) != 0 || !*cs++) -- 1.6.5.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/