OSDN Git Service

net/ethernet/qlogic/qed: force the string buffer NULL-terminated
authorWang Xiayang <xywang.sjtu@sjtu.edu.cn>
Wed, 31 Jul 2019 08:15:42 +0000 (16:15 +0800)
committerDavid S. Miller <davem@davemloft.net>
Sat, 3 Aug 2019 00:57:18 +0000 (17:57 -0700)
strncpy() does not ensure NULL-termination when the input string
size equals to the destination buffer size 30.
The output string is passed to qed_int_deassertion_aeu_bit()
which calls DP_INFO() and relies NULL-termination.

Use strlcpy instead. The other conditional branch above strncpy()
needs no fix as snprintf() ensures NULL-termination.

This issue is identified by a Coccinelle script.

Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/qlogic/qed/qed_int.c

index 4e8118a..9f51136 100644 (file)
@@ -1093,7 +1093,7 @@ static int qed_int_deassertion(struct qed_hwfn  *p_hwfn,
                                                snprintf(bit_name, 30,
                                                         p_aeu->bit_name, num);
                                        else
-                                               strncpy(bit_name,
+                                               strlcpy(bit_name,
                                                        p_aeu->bit_name, 30);
 
                                        /* We now need to pass bitmask in its