Hacker News Reader

Comment by awordnot | Hacker News Reader

I would be careful, a critical buffer overflow vulnerability was just found in the Douane kernel module: https://github.com/Douane/douane-dkms/commit/61023b91fbafab8...

View on HN

Comments like this never fail to make me smile:

    +  // Don't do anything if the process_path length is > PATH_LENGTH
    +  if (strlen(process_path) > PATH_LENGTH)
    +    return;

And it's still wrong, since strncpy() doesn't null terminate: it null pads. That means that if the string is longer than the buffer, it will not be correctly terminated.

They do check the string size before using strncpy though, so it should be fine

The check is off by one. If it's equal in length to the buffer, then the buffer will not be nul terminated.

strcpy() in a kernel module. This is quite horrifying.

Reply on news.ycombinator.com