From cbb98a1de91a6d6013549767624bfe9864a6f8db Mon Sep 17 00:00:00 2001 From: Levi Zim Date: Sat, 16 Sep 2023 12:23:04 +0800 Subject: [PATCH] Copy one extra byte from userspace filename (#958) Otherwise we will rewrite paths for filenames that begins with `/system/bin/su`. This fix copies one extra byte from userspace filename so that when we encounter filenames like `/system/bin/suasf`, `/system/bin/su\0` gets compared with `/system/bin/sua`, which correctly prevents the `su -> sh` path rewriting. Close #957 --- kernel/sucompat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sucompat.c b/kernel/sucompat.c index 1d40ece6..ef08cabd 100644 --- a/kernel/sucompat.c +++ b/kernel/sucompat.c @@ -48,7 +48,7 @@ int ksu_handle_faccessat(int *dfd, const char __user **filename_user, int *mode, return 0; } - char path[sizeof(su)]; + char path[sizeof(su) + 1]; memset(path, 0, sizeof(path)); ksu_strncpy_from_user_nofault(path, *filename_user, sizeof(path)); @@ -73,7 +73,7 @@ int ksu_handle_stat(int *dfd, const char __user **filename_user, int *flags) return 0; } - char path[sizeof(su)]; + char path[sizeof(su) + 1]; memset(path, 0, sizeof(path)); ksu_strncpy_from_user_nofault(path, *filename_user, sizeof(path));