From: Dan Carpenter Date: Tue, 29 May 2018 13:11:28 +0000 (+0300) Subject: EVM: prevent array underflow in evm_write_xattrs() X-Git-Tag: v4.19~858^2~1 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a41d80acfa2764e9b1ce49aa303a263e609d91f7;p=platform%2Fkernel%2Flinux-rpi.git EVM: prevent array underflow in evm_write_xattrs() If the user sets xattr->name[0] to NUL then we would read one character before the start of the array. This bug seems harmless as far as I can see but perhaps it would trigger a warning in KASAN. Fixes: fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs") Signed-off-by: Dan Carpenter Signed-off-by: Mimi Zohar --- diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c index cf5cd303d7c0..3cefef3919e5 100644 --- a/security/integrity/evm/evm_secfs.c +++ b/security/integrity/evm/evm_secfs.c @@ -209,7 +209,7 @@ static ssize_t evm_write_xattrs(struct file *file, const char __user *buf, /* Remove any trailing newline */ len = strlen(xattr->name); - if (xattr->name[len-1] == '\n') + if (len && xattr->name[len-1] == '\n') xattr->name[len-1] = '\0'; if (strcmp(xattr->name, ".") == 0) {