[klibc] strndup(): Fix out of bounds read access
The use of strlen to get the length of the source string can lead to
undetermined memory access if the source string is not finished with a
zero. Use strnlen to prevent this.
Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
Reviewed-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: maximilian attems <max@stro.at>
diff --git a/usr/klibc/strndup.c b/usr/klibc/strndup.c
index 65afd44..e4814be 100644
--- a/usr/klibc/strndup.c
+++ b/usr/klibc/strndup.c
@@ -7,9 +7,8 @@
char *strndup(const char *s, size_t n)
{
- int l = n > strlen(s) ? strlen(s) + 1 : n + 1;
- char *d = malloc(l);
-
+ size_t l = strnlen(s, n);
+ char *d = malloc(l + 1);
if (!d)
return NULL;
