Remove strcat/strncat/strcmp/strncmp. Replaced with safer

alternatives (including a new implementation of strlcat).
Signed-off-by: Keir Fraser <keir@xensource.com>

diff --git a/xen/arch/x86/cpu/cyrix.c b/xen/arch/x86/cpu/cyrix.c
index 754a0755c18a7539b18cb8c170ce553bb415eed1..705afbf18faf31743984321a22771d3fbe350173 100644 (file)
--- a/xen/arch/x86/cpu/cyrix.c
+++ b/xen/arch/x86/cpu/cyrix.c
@@ -302,7 +302,7 @@ static void __init init_cyrix(struct cpuinfo_x86 *c)
                break;
        }
        safe_strcpy(c->x86_model_id, Cx86_model[dir0_msn & 7]);
-       if (p) strcat(c->x86_model_id, p);
+       if (p) safe_strcat(c->x86_model_id, p);
        return;
 }
 

diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 189177e3fd47873ebd6a836a781073531611b073..18110c5f3cf081150fb631ed1832666b4df3a6e7 100644 (file)
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -751,19 +751,19 @@ void __init __start_xen(multiboot_info_t *mbi)
             safe_strcpy(dom0_cmdline, cmdline);
         }
 
-        cmdline = dom0_cmdline;
-
         /* Append any extra parameters. */
-        if ( skip_ioapic_setup && !strstr(cmdline, "noapic") )
-            strcat(cmdline, " noapic");
+        if ( skip_ioapic_setup && !strstr(dom0_cmdline, "noapic") )
+            safe_strcat(dom0_cmdline, " noapic");
         if ( acpi_skip_timer_override &&
-             !strstr(cmdline, "acpi_skip_timer_override") )
-            strcat(cmdline, " acpi_skip_timer_override");
-        if ( (strlen(acpi_param) != 0) && !strstr(cmdline, "acpi=") )
+             !strstr(dom0_cmdline, "acpi_skip_timer_override") )
+            safe_strcat(dom0_cmdline, " acpi_skip_timer_override");
+        if ( (strlen(acpi_param) != 0) && !strstr(dom0_cmdline, "acpi=") )
         {
-            strcat(cmdline, " acpi=");
-            strcat(cmdline, acpi_param);
+            safe_strcat(dom0_cmdline, " acpi=");
+            safe_strcat(dom0_cmdline, acpi_param);
         }
+
+        cmdline = dom0_cmdline;
     }
 
     if ( (initrdidx > 0) && (initrdidx < mbi->mods_count) )

diff --git a/xen/common/string.c b/xen/common/string.c
index df8874c2982380858f3ddceea473243f3ab69e75..562f6cb585d2886774e5319980f5d50099c294e5 100644 (file)
--- a/xen/common/string.c
+++ b/xen/common/string.c
@@ -41,44 +41,6 @@ int strnicmp(const char *s1, const char *s2, size_t len)
 }
 #endif
 
-#ifndef __HAVE_ARCH_STRCPY
-/**
- * strcpy - Copy a %NUL terminated string
- * @dest: Where to copy the string to
- * @src: Where to copy the string from
- */
-char * strcpy(char * dest,const char *src)
-{
-       char *tmp = dest;
-
-       while ((*dest++ = *src++) != '\0')
-               /* nothing */;
-       return tmp;
-}
-#endif
-
-#ifndef __HAVE_ARCH_STRNCPY
-/**
- * strncpy - Copy a length-limited, %NUL-terminated string
- * @dest: Where to copy the string to
- * @src: Where to copy the string from
- * @count: The maximum number of bytes to copy
- *
- * Note that unlike userspace strncpy, this does not %NUL-pad the buffer.
- * However, the result is not %NUL-terminated if the source exceeds
- * @count bytes.
- */
-char * strncpy(char * dest,const char *src,size_t count)
-{
-       char *tmp = dest;
-
-       while (count-- && (*dest++ = *src++) != '\0')
-               /* nothing */;
-
-       return tmp;
-}
-#endif
-
 #ifndef __HAVE_ARCH_STRLCPY
 /**
  * strlcpy - Copy a %NUL terminated string into a sized buffer
@@ -105,52 +67,33 @@ size_t strlcpy(char *dest, const char *src, size_t size)
 EXPORT_SYMBOL(strlcpy);
 #endif
 
-#ifndef __HAVE_ARCH_STRCAT
-/**
- * strcat - Append one %NUL-terminated string to another
- * @dest: The string to be appended to
- * @src: The string to append to it
- */
-char * strcat(char * dest, const char * src)
-{
-       char *tmp = dest;
-
-       while (*dest)
-               dest++;
-       while ((*dest++ = *src++) != '\0')
-               ;
-
-       return tmp;
-}
-#endif
-
-#ifndef __HAVE_ARCH_STRNCAT
+#ifndef __HAVE_ARCH_STRLCAT
 /**
- * strncat - Append a length-limited, %NUL-terminated string to another
- * @dest: The string to be appended to
- * @src: The string to append to it
- * @count: The maximum numbers of bytes to copy
+ * strlcat - Append a %NUL terminated string into a sized buffer
+ * @dest: Where to copy the string to
+ * @src: Where to copy the string from
+ * @size: size of destination buffer
  *
- * Note that in contrast to strncpy, strncat ensures the result is
- * terminated.
+ * Compatible with *BSD: the result is always a valid
+ * NUL-terminated string that fits in the buffer (unless,
+ * of course, the buffer size is zero).
  */
-char * strncat(char *dest, const char *src, size_t count)
+size_t strlcat(char *dest, const char *src, size_t size)
 {
-       char *tmp = dest;
+       size_t slen = strlen(src);
+       size_t dlen = strnlen(dest, size);
+       char *p = dest + dlen;
 
-       if (count) {
-               while (*dest)
-                       dest++;
-               while ((*dest++ = *src++)) {
-                       if (--count == 0) {
-                               *dest = '\0';
-                               break;
-                       }
-               }
-       }
+       while ((p - dest) < size)
+               if ((*p++ = *src++) == '\0')
+                       break;
+
+       if (dlen < size)
+               *(p-1) = '\0';
 
-       return tmp;
+       return slen + dlen;
 }
+EXPORT_SYMBOL(strlcat);
 #endif
 
 #ifndef __HAVE_ARCH_STRCMP

diff --git a/xen/include/xen/string.h b/xen/include/xen/string.h
index f40bcbc3d0084123b6649a39ce1817e2d4c5f9e3..d0c23a14116d159199a434f9ad279c38f102b6fe 100644 (file)
--- a/xen/include/xen/string.h
+++ b/xen/include/xen/string.h
@@ -19,20 +19,20 @@ extern __kernel_size_t strspn(const char *,const char *);
  */
 #include <asm/string.h>
 
-#ifndef __HAVE_ARCH_STRCPY
-extern char * strcpy(char *,const char *);
-#endif
-#ifndef __HAVE_ARCH_STRNCPY
-extern char * strncpy(char *,const char *, __kernel_size_t);
-#endif
+/*
+ * These string functions are considered too dangerous for normal use.
+ * Use safe_strcpy(), safe_strcat(), strlcpy(), strlcat() as appropriate.
+ */
+#define strcpy  __xen_has_no_strcpy__
+#define strcat  __xen_has_no_strcat__
+#define strncpy __xen_has_no_strncpy__
+#define strncat __xen_has_no_strncat__
+
 #ifndef __HAVE_ARCH_STRLCPY
 extern size_t strlcpy(char *,const char *, __kernel_size_t);
 #endif
-#ifndef __HAVE_ARCH_STRCAT
-extern char * strcat(char *, const char *);
-#endif
-#ifndef __HAVE_ARCH_STRNCAT
-extern char * strncat(char *, const char *, __kernel_size_t);
+#ifndef __HAVE_ARCH_STRLCAT
+extern size_t strlcat(char *,const char *, __kernel_size_t);
 #endif
 #ifndef __HAVE_ARCH_STRCMP
 extern int strcmp(const char *,const char *);
@@ -82,6 +82,8 @@ extern void * memchr(const void *,int,__kernel_size_t);
 }
 #endif
 
-#define safe_strcpy(d, s) strlcpy(d, s, sizeof(d))
+/* safe_xxx always NUL-terminates and returns !=0 if result is truncated. */
+#define safe_strcpy(d, s) (strlcpy(d, s, sizeof(d)) >= sizeof(d))
+#define safe_strcat(d, s) (strlcat(d, s, sizeof(d)) >= sizeof(d))
 
 #endif /* _LINUX_STRING_H_ */