[PATCH] tomoyo: reject short exec.envp[] names before suffix checks

Tetsuo Handa penguin-kernel at I-love.SAKURA.ne.jp
Fri Apr 17 09:09:10 UTC 2026


Thank you for a patch, but I don't think we need to apply this patch.

The caller is

    if (!strncmp(left_word, "exec.envp[\"", 11)) {
        (...snipped...)
        if (!tomoyo_parse_envp(left_word + 11, right_word, envp++)) goto out;
        (...snipped...)
    }

where the left-hand string is guaranteed to be safely dereferenced.




More information about the Linux-security-module-archive mailing list