geemili
/
drm
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

xf86drm: Bound strstr() to the allocated data 

We are reading at most sizeof(data) bytes, but then data may not contain
a terminating '\0', at least in theory, so strstr() may overflow the
stack allocated array.

Make sure that data always contains at least one '\0'.

Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
main
Damien Lespiau 2016-01-22 12:41:55 +00:00
parent db138b9ba1
commit 3627f38da9
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
xf86drm.c
View File

@ -2863,7 +2863,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info)
{
#ifdef __linux__
char path[PATH_MAX + 1];
char data[128];
char data[128 + 1];
char *str;
int domain, bus, dev, func;
int fd, ret;
@ -2874,6 +2874,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info)
return -errno;
ret = read(fd, data, sizeof(data));
data[128] = '\0';
close(fd);
if (ret < 0)
return -errno;