Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Segmentationfault using ebbchar #31

Open
TheUnlimited64 opened this issue Jun 18, 2023 · 0 comments
Open

Segmentationfault using ebbchar #31

TheUnlimited64 opened this issue Jun 18, 2023 · 0 comments

Comments

@TheUnlimited64
Copy link

I noticed that the ebbchar produces an segfault due to reliying on \0

Following code:

static ssize_t dev_write(struct file *filep, const char *buffer, size_t len, loff_t *offset){
   sprintf(message, "%s(%zu letters)", buffer, len);   // appending received string with its length
   size_of_message = strlen(message);                 // store the length of the stored message
   printk(KERN_INFO "EBBChar: Received %zu characters from the user\n", len);
   return len;
}

Is faulty, because if gets "a" an input, len will be 1. If I now access the \0, I get an segmentation fault.

printk(KERN_INFO "%c ", *(buffer+1));

This will trigger the segfault.

This is due the usage of strlen method, that will count up to the \0, but not include it.

ret = write(fd, stringToSend, strlen(stringToSend)); // Send the string to the LKM

Tested on 5.15.90.1 (on WSL2, with custom compiled kernel, allowing loading of modules)

I can't say if it worked in previous Versions of Linux due to forcing the \0 as allowed space or something, but it seems to got changed

Also Im not an expert, but shouldn't you better rely on len instead of \0? Im critical about the usage of \0 in C

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant