[Bug libc/26657] New: strncpy in login/login.c line 114 might leave the destination string unterminate

[Bug libc/26657] New: strncpy in login/login.c line 114 might leave the destination string unterminate

[xiechengliang1 at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26657

            Bug ID: 26657
           Summary: strncpy in login/login.c line 114 might leave the
                    destination string unterminate
           Product: glibc
           Version: 2.31
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: xiechengliang1 at huawei dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

The glibc-2.31/login/login.c 114 line contains the following code:
    strncpy (copy.ut_line, ttyp, UT_LINESIZE);

  The UT_LINESIZE size is 32 bytes，and the size of the destination array
"copy.ut_line" is also 32 bytes. The code cannot ensure that the "ttyp" ends
with '\0'. so calling "strncpy" might leave the destination string
unterminated. When strlen is used to obtain the length of the "copy.ut_line"
array, a buffer overflow occurs.

  Consider setting the 32nd bit of the "copy.ut_line" array to '\0' to fix it.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/26657] strncpy in login/login.c line 114 might leave the destination string unterminate

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26657

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> ---
This is not a bug.  The fields in the utmp file are not strings, but fixed size
records.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/26657] strncpy in login/login.c line 114 might leave the destination string unterminate

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26657

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-
                 CC|                            |fweimer at redhat dot com

--- Comment #2 from Florian Weimer <fweimer at redhat dot com> ---
And this why we have marked those strings with the nonstring attribute. In case
you use a static analysis tool to catch these issues, you should teach it about
the attribute, so that the tool does not issue such false reports.

-- 
You are receiving this mail because:
You are on the CC list for the bug.