git/linux-cryptodev-2.6
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git synced 2026-04-18 03:23:53 -04:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: replace sprintf with snprintf in aa_new_learning_profile

Browse Source 
Replace unbounded sprintf() calls with snprintf() to prevent potential
buffer overflows in aa_new_learning_profile(). While the current code
works correctly, snprintf() is safer and follows secure coding best
practices.  No functional changes.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Thorsten Blum
2025-11-22 12:54:46 +01:00
committed by John Johansen
parent 8f0b4cce44
commit 7db8c3c738
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
security/apparmor/policy.c
View File

@@ -697,24 +697,27 @@ struct aa_profile *aa_new_learning_profile(struct aa_profile *parent, bool hat,
struct aa_profile *p, *profile; struct aa_profile *p, *profile;
const char *bname; const char *bname;
char *name = NULL; char *name = NULL;
size_t name_sz;
AA_BUG(!parent); AA_BUG(!parent);
if (base) { if (base) {
name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base), name_sz = strlen(parent->base.hname) + 8 + strlen(base);
gfp); name = kmalloc(name_sz, gfp);
if (name) { if (name) {
sprintf(name, "%s//null-%s", parent->base.hname, base); snprintf(name, name_sz, "%s//null-%s",
parent->base.hname, base);
goto name; goto name;
} }
/* fall through to try shorter uniq */ /* fall through to try shorter uniq */
} }
name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp); name_sz = strlen(parent->base.hname) + 2 + 7 + 8;
name = kmalloc(name_sz, gfp);
if (!name) if (!name)
return NULL; return NULL;
sprintf(name, "%s//null-%x", parent->base.hname, snprintf(name, name_sz, "%s//null-%x", parent->base.hname,
atomic_inc_return(&parent->ns->uniq_null)); atomic_inc_return(&parent->ns->uniq_null));
name: name:
/* lookup to see if this is a dup creation */ /* lookup to see if this is a dup creation */