Commit | Line | Data |
---|---|---|
a28a6e86 FL |
1 | /* SPDX-License-Identifier: GPL-2.0 */ |
2 | #ifndef _LINUX_FORTIFY_STRING_H_ | |
3 | #define _LINUX_FORTIFY_STRING_H_ | |
4 | ||
67ebc3ab KC |
5 | #include <linux/const.h> |
6 | ||
281d0c96 | 7 | #define __FORTIFY_INLINE extern __always_inline __gnu_inline __overloadable |
c430f600 KC |
8 | #define __RENAME(x) __asm__(#x) |
9 | ||
10 | void fortify_panic(const char *name) __noreturn __cold; | |
11 | void __read_overflow(void) __compiletime_error("detected read beyond size of object (1st parameter)"); | |
12 | void __read_overflow2(void) __compiletime_error("detected read beyond size of object (2nd parameter)"); | |
f68f2ff9 | 13 | void __read_overflow2_field(size_t avail, size_t wanted) __compiletime_warning("detected read beyond size of field (2nd parameter); maybe use struct_group()?"); |
c430f600 | 14 | void __write_overflow(void) __compiletime_error("detected write beyond size of object (1st parameter)"); |
f68f2ff9 | 15 | void __write_overflow_field(size_t avail, size_t wanted) __compiletime_warning("detected write beyond size of field (1st parameter); maybe use struct_group()?"); |
a28a6e86 | 16 | |
95cadae3 QC |
17 | #define __compiletime_strlen(p) \ |
18 | ({ \ | |
19 | unsigned char *__p = (unsigned char *)(p); \ | |
20 | size_t __ret = (size_t)-1; \ | |
21 | size_t __p_size = __builtin_object_size(p, 1); \ | |
22 | if (__p_size != (size_t)-1) { \ | |
23 | size_t __p_len = __p_size - 1; \ | |
24 | if (__builtin_constant_p(__p[__p_len]) && \ | |
25 | __p[__p_len] == '\0') \ | |
26 | __ret = __builtin_strlen(__p); \ | |
27 | } \ | |
28 | __ret; \ | |
3009f891 KC |
29 | }) |
30 | ||
a28a6e86 FL |
31 | #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) |
32 | extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr); | |
33 | extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp); | |
34 | extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy); | |
35 | extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove); | |
36 | extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset); | |
37 | extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat); | |
38 | extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy); | |
39 | extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen); | |
40 | extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat); | |
41 | extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy); | |
42 | #else | |
43 | #define __underlying_memchr __builtin_memchr | |
44 | #define __underlying_memcmp __builtin_memcmp | |
45 | #define __underlying_memcpy __builtin_memcpy | |
46 | #define __underlying_memmove __builtin_memmove | |
47 | #define __underlying_memset __builtin_memset | |
48 | #define __underlying_strcat __builtin_strcat | |
49 | #define __underlying_strcpy __builtin_strcpy | |
50 | #define __underlying_strlen __builtin_strlen | |
51 | #define __underlying_strncat __builtin_strncat | |
52 | #define __underlying_strncpy __builtin_strncpy | |
53 | #endif | |
54 | ||
43213dae KC |
55 | /** |
56 | * unsafe_memcpy - memcpy implementation with no FORTIFY bounds checking | |
57 | * | |
58 | * @dst: Destination memory address to write to | |
59 | * @src: Source memory address to read from | |
60 | * @bytes: How many bytes to write to @dst from @src | |
61 | * @justification: Free-form text or comment describing why the use is needed | |
62 | * | |
63 | * This should be used for corner cases where the compiler cannot do the | |
64 | * right thing, or during transitions between APIs, etc. It should be used | |
65 | * very rarely, and includes a place for justification detailing where bounds | |
66 | * checking has happened, and why existing solutions cannot be employed. | |
67 | */ | |
68 | #define unsafe_memcpy(dst, src, bytes, justification) \ | |
69 | __underlying_memcpy(dst, src, bytes) | |
70 | ||
281d0c96 KC |
71 | /* |
72 | * Clang's use of __builtin_object_size() within inlines needs hinting via | |
73 | * __pass_object_size(). The preference is to only ever use type 1 (member | |
74 | * size, rather than struct size), but there remain some stragglers using | |
75 | * type 0 that will be converted in the future. | |
76 | */ | |
77 | #define POS __pass_object_size(1) | |
78 | #define POS0 __pass_object_size(0) | |
79 | ||
92df138a | 80 | __FORTIFY_INLINE __diagnose_as(__builtin_strncpy, 1, 2, 3) |
281d0c96 | 81 | char *strncpy(char * const POS p, const char *q, __kernel_size_t size) |
a28a6e86 FL |
82 | { |
83 | size_t p_size = __builtin_object_size(p, 1); | |
84 | ||
85 | if (__builtin_constant_p(size) && p_size < size) | |
86 | __write_overflow(); | |
87 | if (p_size < size) | |
88 | fortify_panic(__func__); | |
89 | return __underlying_strncpy(p, q, size); | |
90 | } | |
91 | ||
92df138a | 92 | __FORTIFY_INLINE __diagnose_as(__builtin_strcat, 1, 2) |
281d0c96 | 93 | char *strcat(char * const POS p, const char *q) |
a28a6e86 FL |
94 | { |
95 | size_t p_size = __builtin_object_size(p, 1); | |
96 | ||
97 | if (p_size == (size_t)-1) | |
98 | return __underlying_strcat(p, q); | |
99 | if (strlcat(p, q, p_size) >= p_size) | |
100 | fortify_panic(__func__); | |
101 | return p; | |
102 | } | |
103 | ||
369cd216 | 104 | extern __kernel_size_t __real_strnlen(const char *, __kernel_size_t) __RENAME(strnlen); |
281d0c96 | 105 | __FORTIFY_INLINE __kernel_size_t strnlen(const char * const POS p, __kernel_size_t maxlen) |
369cd216 KC |
106 | { |
107 | size_t p_size = __builtin_object_size(p, 1); | |
3009f891 KC |
108 | size_t p_len = __compiletime_strlen(p); |
109 | size_t ret; | |
110 | ||
111 | /* We can take compile-time actions when maxlen is const. */ | |
112 | if (__builtin_constant_p(maxlen) && p_len != (size_t)-1) { | |
113 | /* If p is const, we can use its compile-time-known len. */ | |
114 | if (maxlen >= p_size) | |
115 | return p_len; | |
116 | } | |
369cd216 | 117 | |
3009f891 KC |
118 | /* Do not check characters beyond the end of p. */ |
119 | ret = __real_strnlen(p, maxlen < p_size ? maxlen : p_size); | |
369cd216 KC |
120 | if (p_size <= ret && maxlen != ret) |
121 | fortify_panic(__func__); | |
122 | return ret; | |
123 | } | |
124 | ||
67ebc3ab KC |
125 | /* |
126 | * Defined after fortified strnlen to reuse it. However, it must still be | |
127 | * possible for strlen() to be used on compile-time strings for use in | |
128 | * static initializers (i.e. as a constant expression). | |
129 | */ | |
130 | #define strlen(p) \ | |
131 | __builtin_choose_expr(__is_constexpr(__builtin_strlen(p)), \ | |
132 | __builtin_strlen(p), __fortify_strlen(p)) | |
92df138a | 133 | __FORTIFY_INLINE __diagnose_as(__builtin_strlen, 1) |
281d0c96 | 134 | __kernel_size_t __fortify_strlen(const char * const POS p) |
a28a6e86 FL |
135 | { |
136 | __kernel_size_t ret; | |
137 | size_t p_size = __builtin_object_size(p, 1); | |
138 | ||
3009f891 KC |
139 | /* Give up if we don't know how large p is. */ |
140 | if (p_size == (size_t)-1) | |
a28a6e86 FL |
141 | return __underlying_strlen(p); |
142 | ret = strnlen(p, p_size); | |
143 | if (p_size <= ret) | |
144 | fortify_panic(__func__); | |
145 | return ret; | |
146 | } | |
147 | ||
a28a6e86 FL |
148 | /* defined after fortified strlen to reuse it */ |
149 | extern size_t __real_strlcpy(char *, const char *, size_t) __RENAME(strlcpy); | |
281d0c96 | 150 | __FORTIFY_INLINE size_t strlcpy(char * const POS p, const char * const POS q, size_t size) |
a28a6e86 | 151 | { |
a28a6e86 FL |
152 | size_t p_size = __builtin_object_size(p, 1); |
153 | size_t q_size = __builtin_object_size(q, 1); | |
3009f891 KC |
154 | size_t q_len; /* Full count of source string length. */ |
155 | size_t len; /* Count of characters going into destination. */ | |
a28a6e86 FL |
156 | |
157 | if (p_size == (size_t)-1 && q_size == (size_t)-1) | |
158 | return __real_strlcpy(p, q, size); | |
3009f891 KC |
159 | q_len = strlen(q); |
160 | len = (q_len >= size) ? size - 1 : q_len; | |
161 | if (__builtin_constant_p(size) && __builtin_constant_p(q_len) && size) { | |
162 | /* Write size is always larger than destination. */ | |
163 | if (len >= p_size) | |
a28a6e86 | 164 | __write_overflow(); |
3009f891 KC |
165 | } |
166 | if (size) { | |
a28a6e86 FL |
167 | if (len >= p_size) |
168 | fortify_panic(__func__); | |
169 | __underlying_memcpy(p, q, len); | |
170 | p[len] = '\0'; | |
171 | } | |
3009f891 | 172 | return q_len; |
a28a6e86 FL |
173 | } |
174 | ||
175 | /* defined after fortified strnlen to reuse it */ | |
176 | extern ssize_t __real_strscpy(char *, const char *, size_t) __RENAME(strscpy); | |
281d0c96 | 177 | __FORTIFY_INLINE ssize_t strscpy(char * const POS p, const char * const POS q, size_t size) |
a28a6e86 FL |
178 | { |
179 | size_t len; | |
180 | /* Use string size rather than possible enclosing struct size. */ | |
181 | size_t p_size = __builtin_object_size(p, 1); | |
182 | size_t q_size = __builtin_object_size(q, 1); | |
183 | ||
184 | /* If we cannot get size of p and q default to call strscpy. */ | |
185 | if (p_size == (size_t) -1 && q_size == (size_t) -1) | |
186 | return __real_strscpy(p, q, size); | |
187 | ||
188 | /* | |
189 | * If size can be known at compile time and is greater than | |
190 | * p_size, generate a compile time write overflow error. | |
191 | */ | |
192 | if (__builtin_constant_p(size) && size > p_size) | |
193 | __write_overflow(); | |
194 | ||
195 | /* | |
196 | * This call protects from read overflow, because len will default to q | |
197 | * length if it smaller than size. | |
198 | */ | |
199 | len = strnlen(q, size); | |
200 | /* | |
201 | * If len equals size, we will copy only size bytes which leads to | |
202 | * -E2BIG being returned. | |
203 | * Otherwise we will copy len + 1 because of the final '\O'. | |
204 | */ | |
205 | len = len == size ? size : len + 1; | |
206 | ||
207 | /* | |
208 | * Generate a runtime write overflow error if len is greater than | |
209 | * p_size. | |
210 | */ | |
211 | if (len > p_size) | |
212 | fortify_panic(__func__); | |
213 | ||
214 | /* | |
215 | * We can now safely call vanilla strscpy because we are protected from: | |
216 | * 1. Read overflow thanks to call to strnlen(). | |
217 | * 2. Write overflow thanks to above ifs. | |
218 | */ | |
219 | return __real_strscpy(p, q, len); | |
220 | } | |
221 | ||
222 | /* defined after fortified strlen and strnlen to reuse them */ | |
92df138a | 223 | __FORTIFY_INLINE __diagnose_as(__builtin_strncat, 1, 2, 3) |
281d0c96 | 224 | char *strncat(char * const POS p, const char * const POS q, __kernel_size_t count) |
a28a6e86 FL |
225 | { |
226 | size_t p_len, copy_len; | |
227 | size_t p_size = __builtin_object_size(p, 1); | |
228 | size_t q_size = __builtin_object_size(q, 1); | |
229 | ||
230 | if (p_size == (size_t)-1 && q_size == (size_t)-1) | |
231 | return __underlying_strncat(p, q, count); | |
232 | p_len = strlen(p); | |
233 | copy_len = strnlen(q, count); | |
234 | if (p_size < p_len + copy_len + 1) | |
235 | fortify_panic(__func__); | |
236 | __underlying_memcpy(p + p_len, q, copy_len); | |
237 | p[p_len + copy_len] = '\0'; | |
238 | return p; | |
239 | } | |
240 | ||
28e77cc1 KC |
241 | __FORTIFY_INLINE void fortify_memset_chk(__kernel_size_t size, |
242 | const size_t p_size, | |
243 | const size_t p_size_field) | |
a28a6e86 | 244 | { |
28e77cc1 KC |
245 | if (__builtin_constant_p(size)) { |
246 | /* | |
247 | * Length argument is a constant expression, so we | |
248 | * can perform compile-time bounds checking where | |
249 | * buffer sizes are known. | |
250 | */ | |
a28a6e86 | 251 | |
28e77cc1 KC |
252 | /* Error when size is larger than enclosing struct. */ |
253 | if (p_size > p_size_field && p_size < size) | |
254 | __write_overflow(); | |
255 | ||
256 | /* Warn when write size is larger than dest field. */ | |
257 | if (p_size_field < size) | |
258 | __write_overflow_field(p_size_field, size); | |
259 | } | |
260 | /* | |
261 | * At this point, length argument may not be a constant expression, | |
262 | * so run-time bounds checking can be done where buffer sizes are | |
263 | * known. (This is not an "else" because the above checks may only | |
264 | * be compile-time warnings, and we want to still warn for run-time | |
265 | * overflows.) | |
266 | */ | |
267 | ||
268 | /* | |
269 | * Always stop accesses beyond the struct that contains the | |
270 | * field, when the buffer's remaining size is known. | |
271 | * (The -1 test is to optimize away checks where the buffer | |
272 | * lengths are unknown.) | |
273 | */ | |
274 | if (p_size != (size_t)(-1) && p_size < size) | |
275 | fortify_panic("memset"); | |
a28a6e86 FL |
276 | } |
277 | ||
28e77cc1 KC |
278 | #define __fortify_memset_chk(p, c, size, p_size, p_size_field) ({ \ |
279 | size_t __fortify_size = (size_t)(size); \ | |
280 | fortify_memset_chk(__fortify_size, p_size, p_size_field), \ | |
281 | __underlying_memset(p, c, __fortify_size); \ | |
282 | }) | |
283 | ||
284 | /* | |
285 | * __builtin_object_size() must be captured here to avoid evaluating argument | |
286 | * side-effects further into the macro layers. | |
287 | */ | |
288 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \ | |
289 | __builtin_object_size(p, 0), __builtin_object_size(p, 1)) | |
290 | ||
f68f2ff9 KC |
291 | /* |
292 | * To make sure the compiler can enforce protection against buffer overflows, | |
293 | * memcpy(), memmove(), and memset() must not be used beyond individual | |
294 | * struct members. If you need to copy across multiple members, please use | |
295 | * struct_group() to create a named mirror of an anonymous struct union. | |
296 | * (e.g. see struct sk_buff.) Read overflow checking is currently only | |
297 | * done when a write overflow is also present, or when building with W=1. | |
298 | * | |
299 | * Mitigation coverage matrix | |
300 | * Bounds checking at: | |
301 | * +-------+-------+-------+-------+ | |
302 | * | Compile time | Run time | | |
303 | * memcpy() argument sizes: | write | read | write | read | | |
304 | * dest source length +-------+-------+-------+-------+ | |
305 | * memcpy(known, known, constant) | y | y | n/a | n/a | | |
306 | * memcpy(known, unknown, constant) | y | n | n/a | V | | |
307 | * memcpy(known, known, dynamic) | n | n | B | B | | |
308 | * memcpy(known, unknown, dynamic) | n | n | B | V | | |
309 | * memcpy(unknown, known, constant) | n | y | V | n/a | | |
310 | * memcpy(unknown, unknown, constant) | n | n | V | V | | |
311 | * memcpy(unknown, known, dynamic) | n | n | V | B | | |
312 | * memcpy(unknown, unknown, dynamic) | n | n | V | V | | |
313 | * +-------+-------+-------+-------+ | |
314 | * | |
315 | * y = perform deterministic compile-time bounds checking | |
316 | * n = cannot perform deterministic compile-time bounds checking | |
317 | * n/a = no run-time bounds checking needed since compile-time deterministic | |
318 | * B = can perform run-time bounds checking (currently unimplemented) | |
319 | * V = vulnerable to run-time overflow (will need refactoring to solve) | |
320 | * | |
321 | */ | |
322 | __FORTIFY_INLINE void fortify_memcpy_chk(__kernel_size_t size, | |
323 | const size_t p_size, | |
324 | const size_t q_size, | |
325 | const size_t p_size_field, | |
326 | const size_t q_size_field, | |
327 | const char *func) | |
a28a6e86 | 328 | { |
a28a6e86 | 329 | if (__builtin_constant_p(size)) { |
f68f2ff9 KC |
330 | /* |
331 | * Length argument is a constant expression, so we | |
332 | * can perform compile-time bounds checking where | |
333 | * buffer sizes are known. | |
334 | */ | |
335 | ||
336 | /* Error when size is larger than enclosing struct. */ | |
337 | if (p_size > p_size_field && p_size < size) | |
a28a6e86 | 338 | __write_overflow(); |
f68f2ff9 | 339 | if (q_size > q_size_field && q_size < size) |
a28a6e86 | 340 | __read_overflow2(); |
f68f2ff9 KC |
341 | |
342 | /* Warn when write size argument larger than dest field. */ | |
343 | if (p_size_field < size) | |
344 | __write_overflow_field(p_size_field, size); | |
345 | /* | |
346 | * Warn for source field over-read when building with W=1 | |
347 | * or when an over-write happened, so both can be fixed at | |
348 | * the same time. | |
349 | */ | |
350 | if ((IS_ENABLED(KBUILD_EXTRA_WARN1) || p_size_field < size) && | |
351 | q_size_field < size) | |
352 | __read_overflow2_field(q_size_field, size); | |
a28a6e86 | 353 | } |
f68f2ff9 KC |
354 | /* |
355 | * At this point, length argument may not be a constant expression, | |
356 | * so run-time bounds checking can be done where buffer sizes are | |
357 | * known. (This is not an "else" because the above checks may only | |
358 | * be compile-time warnings, and we want to still warn for run-time | |
359 | * overflows.) | |
360 | */ | |
361 | ||
362 | /* | |
363 | * Always stop accesses beyond the struct that contains the | |
364 | * field, when the buffer's remaining size is known. | |
365 | * (The -1 test is to optimize away checks where the buffer | |
366 | * lengths are unknown.) | |
367 | */ | |
368 | if ((p_size != (size_t)(-1) && p_size < size) || | |
369 | (q_size != (size_t)(-1) && q_size < size)) | |
370 | fortify_panic(func); | |
a28a6e86 FL |
371 | } |
372 | ||
f68f2ff9 KC |
373 | #define __fortify_memcpy_chk(p, q, size, p_size, q_size, \ |
374 | p_size_field, q_size_field, op) ({ \ | |
375 | size_t __fortify_size = (size_t)(size); \ | |
376 | fortify_memcpy_chk(__fortify_size, p_size, q_size, \ | |
377 | p_size_field, q_size_field, #op); \ | |
378 | __underlying_##op(p, q, __fortify_size); \ | |
379 | }) | |
380 | ||
381 | /* | |
382 | * __builtin_object_size() must be captured here to avoid evaluating argument | |
383 | * side-effects further into the macro layers. | |
384 | */ | |
385 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | |
386 | __builtin_object_size(p, 0), __builtin_object_size(q, 0), \ | |
387 | __builtin_object_size(p, 1), __builtin_object_size(q, 1), \ | |
388 | memcpy) | |
938a000e KC |
389 | #define memmove(p, q, s) __fortify_memcpy_chk(p, q, s, \ |
390 | __builtin_object_size(p, 0), __builtin_object_size(q, 0), \ | |
391 | __builtin_object_size(p, 1), __builtin_object_size(q, 1), \ | |
392 | memmove) | |
a28a6e86 FL |
393 | |
394 | extern void *__real_memscan(void *, int, __kernel_size_t) __RENAME(memscan); | |
281d0c96 | 395 | __FORTIFY_INLINE void *memscan(void * const POS0 p, int c, __kernel_size_t size) |
a28a6e86 FL |
396 | { |
397 | size_t p_size = __builtin_object_size(p, 0); | |
398 | ||
399 | if (__builtin_constant_p(size) && p_size < size) | |
400 | __read_overflow(); | |
401 | if (p_size < size) | |
402 | fortify_panic(__func__); | |
403 | return __real_memscan(p, c, size); | |
404 | } | |
405 | ||
92df138a | 406 | __FORTIFY_INLINE __diagnose_as(__builtin_memcmp, 1, 2, 3) |
281d0c96 | 407 | int memcmp(const void * const POS0 p, const void * const POS0 q, __kernel_size_t size) |
a28a6e86 FL |
408 | { |
409 | size_t p_size = __builtin_object_size(p, 0); | |
410 | size_t q_size = __builtin_object_size(q, 0); | |
411 | ||
412 | if (__builtin_constant_p(size)) { | |
413 | if (p_size < size) | |
414 | __read_overflow(); | |
415 | if (q_size < size) | |
416 | __read_overflow2(); | |
417 | } | |
418 | if (p_size < size || q_size < size) | |
419 | fortify_panic(__func__); | |
420 | return __underlying_memcmp(p, q, size); | |
421 | } | |
422 | ||
92df138a | 423 | __FORTIFY_INLINE __diagnose_as(__builtin_memchr, 1, 2, 3) |
281d0c96 | 424 | void *memchr(const void * const POS0 p, int c, __kernel_size_t size) |
a28a6e86 FL |
425 | { |
426 | size_t p_size = __builtin_object_size(p, 0); | |
427 | ||
428 | if (__builtin_constant_p(size) && p_size < size) | |
429 | __read_overflow(); | |
430 | if (p_size < size) | |
431 | fortify_panic(__func__); | |
432 | return __underlying_memchr(p, c, size); | |
433 | } | |
434 | ||
435 | void *__real_memchr_inv(const void *s, int c, size_t n) __RENAME(memchr_inv); | |
281d0c96 | 436 | __FORTIFY_INLINE void *memchr_inv(const void * const POS0 p, int c, size_t size) |
a28a6e86 FL |
437 | { |
438 | size_t p_size = __builtin_object_size(p, 0); | |
439 | ||
440 | if (__builtin_constant_p(size) && p_size < size) | |
441 | __read_overflow(); | |
442 | if (p_size < size) | |
443 | fortify_panic(__func__); | |
444 | return __real_memchr_inv(p, c, size); | |
445 | } | |
446 | ||
447 | extern void *__real_kmemdup(const void *src, size_t len, gfp_t gfp) __RENAME(kmemdup); | |
281d0c96 | 448 | __FORTIFY_INLINE void *kmemdup(const void * const POS0 p, size_t size, gfp_t gfp) |
a28a6e86 FL |
449 | { |
450 | size_t p_size = __builtin_object_size(p, 0); | |
451 | ||
452 | if (__builtin_constant_p(size) && p_size < size) | |
453 | __read_overflow(); | |
454 | if (p_size < size) | |
455 | fortify_panic(__func__); | |
456 | return __real_kmemdup(p, size, gfp); | |
457 | } | |
458 | ||
f68f2ff9 | 459 | /* Defined after fortified strlen to reuse it. */ |
92df138a | 460 | __FORTIFY_INLINE __diagnose_as(__builtin_strcpy, 1, 2) |
281d0c96 | 461 | char *strcpy(char * const POS p, const char * const POS q) |
a28a6e86 FL |
462 | { |
463 | size_t p_size = __builtin_object_size(p, 1); | |
464 | size_t q_size = __builtin_object_size(q, 1); | |
465 | size_t size; | |
466 | ||
f68f2ff9 | 467 | /* If neither buffer size is known, immediately give up. */ |
a28a6e86 FL |
468 | if (p_size == (size_t)-1 && q_size == (size_t)-1) |
469 | return __underlying_strcpy(p, q); | |
470 | size = strlen(q) + 1; | |
072af0c6 KC |
471 | /* Compile-time check for const size overflow. */ |
472 | if (__builtin_constant_p(size) && p_size < size) | |
473 | __write_overflow(); | |
474 | /* Run-time check for dynamic size overflow. */ | |
a28a6e86 FL |
475 | if (p_size < size) |
476 | fortify_panic(__func__); | |
f68f2ff9 | 477 | __underlying_memcpy(p, q, size); |
a28a6e86 FL |
478 | return p; |
479 | } | |
480 | ||
481 | /* Don't use these outside the FORITFY_SOURCE implementation */ | |
482 | #undef __underlying_memchr | |
483 | #undef __underlying_memcmp | |
a28a6e86 FL |
484 | #undef __underlying_strcat |
485 | #undef __underlying_strcpy | |
486 | #undef __underlying_strlen | |
487 | #undef __underlying_strncat | |
488 | #undef __underlying_strncpy | |
489 | ||
281d0c96 KC |
490 | #undef POS |
491 | #undef POS0 | |
492 | ||
a28a6e86 | 493 | #endif /* _LINUX_FORTIFY_STRING_H_ */ |