[PATCH] um: mconsole: validate notify socket path length

[Pengpeng Hou]

mconsole_notify() copies the notify socket path into sockaddr_un.sun_path with strcpy(). There is no local check that the supplied path fits in the fixed Unix-domain socket path buffer.

Reject notify socket paths that do not fit in sun_path instead of copying them blindly.

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 arch/um/drivers/mconsole_user.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/um/drivers/mconsole_user.c b/arch/um/drivers/mconsole_user.c
index a04cd13c6315..2c0d2984055c 100644
--- a/arch/um/drivers/mconsole_user.c
+++ b/arch/um/drivers/mconsole_user.c
@@ -198,8 +198,11 @@ int mconsole_notify(char *sock_name, int type, const void *data, int len)
 	if (err)
 		return err;
 
+	memset(&target, 0, sizeof(target));
 	target.sun_family = AF_UNIX;
-	strcpy(target.sun_path, sock_name);
+	if (snprintf(target.sun_path, sizeof(target.sun_path), "%s", sock_name) >=
+	    sizeof(target.sun_path))
+		return -EINVAL;
 
 	packet.magic = MCONSOLE_MAGIC;
 	packet.version = MCONSOLE_VERSION;
-- 
2.50.1 (Apple Git-155)