PSARC/2008/047 Adding strnlen() to implementation of PSARC/1998/399

6654389 vsnprintf: can provoke a panic when "%4.4s" is handed an unterminated string

2 files changed, 25 insertions, 7 deletions

diff --git a/usr/src/common/util/string.c b/usr/src/common/util/string.c
index 73063ead61..13ee635ad6 100644
--- a/usr/src/common/util/string.c
+++ b/usr/src/common/util/string.c
@@ -19,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -191,15 +191,13 @@ next_fmt:
 					ADDCHAR(c);
 				break;
 			}
-			transfer_count = strlen(sp);
 			if (prec > 0) {
-				/* trim string if too long */
-				if (transfer_count > prec)
-					transfer_count = prec;
+				transfer_count = strnlen(sp, prec);
 				/* widen field if too narrow */
 				if (prec > width)
 					width = prec;
-			}
+			} else
+				transfer_count = strlen(sp);
 			if (width > transfer_count)
 				pad_count = width - transfer_count;
 			else
@@ -732,6 +730,25 @@ strlen(const char *s)
 
 #endif /* _BOOT || _KMDB */
 
+/*
+ * Returns the number of non-NULL bytes in string argument,
+ * but not more than maxlen.  Does not look past str + maxlen.
+ */
+size_t
+strnlen(const char *s, size_t maxlen)
+{
+	size_t n = 0;
+
+	while (maxlen != 0 && *s != 0) {
+		s++;
+		maxlen--;
+		n++;
+	}
+
+	return (n);
+}
+
+
 #ifdef _KERNEL
 /*
  * Check for a valid C identifier:
diff --git a/usr/src/common/util/string.h b/usr/src/common/util/string.h
index c7db1bf967..052eeab4a4 100644
--- a/usr/src/common/util/string.h
+++ b/usr/src/common/util/string.h
@@ -20,7 +20,7 @@
  */
 
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -65,6 +65,7 @@ extern char *strncat(char *, const char *, size_t);
 extern size_t strlcat(char *, const char *, size_t);
 extern size_t strlcpy(char *, const char *, size_t);
 extern size_t strspn(const char *, const char *);
+extern size_t strnlen(const char *, size_t);
 
 #if defined(_BOOT) || defined(_KMDB)