From owner-svn-src-head@freebsd.org Wed Nov 22 19:57:35 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 72682DF409B; Wed, 22 Nov 2017 19:57:35 +0000 (UTC) (envelope-from asomers@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4D1A867252; Wed, 22 Nov 2017 19:57:35 +0000 (UTC) (envelope-from asomers@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id vAMJvYjU061166; Wed, 22 Nov 2017 19:57:34 GMT (envelope-from asomers@FreeBSD.org) Received: (from asomers@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id vAMJvYOb061165; Wed, 22 Nov 2017 19:57:34 GMT (envelope-from asomers@FreeBSD.org) Message-Id: <201711221957.vAMJvYOb061165@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: asomers set sender to asomers@FreeBSD.org using -f From: Alan Somers Date: Wed, 22 Nov 2017 19:57:34 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r326100 - head/sys/cam X-SVN-Group: head X-SVN-Commit-Author: asomers X-SVN-Commit-Paths: head/sys/cam X-SVN-Commit-Revision: 326100 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Nov 2017 19:57:35 -0000 Author: asomers Date: Wed Nov 22 19:57:34 2017 New Revision: 326100 URL: https://svnweb.freebsd.org/changeset/base/326100 Log: Always null-terminate CAM periph_name and dev_name Reported by: Coverity CID: 1010039, 1010040, 1010041, 1010043 Reviewed by: ken, imp MFC after: 3 weeks Sponsored by: Spectra Logic Corp Differential Revision: https://reviews.freebsd.org/D13194 Modified: head/sys/cam/cam_xpt.c Modified: head/sys/cam/cam_xpt.c ============================================================================== --- head/sys/cam/cam_xpt.c Wed Nov 22 18:06:41 2017 (r326099) +++ head/sys/cam/cam_xpt.c Wed Nov 22 19:57:34 2017 (r326100) @@ -686,8 +686,9 @@ xptdoioctl(struct cdev *dev, u_long cmd, caddr_t addr, /* * Fill in the getdevlist fields. */ - strcpy(ccb->cgdl.periph_name, - periph->periph_name); + strlcpy(ccb->cgdl.periph_name, + periph->periph_name, + sizeof(ccb->cgdl.periph_name)); ccb->cgdl.unit_number = periph->unit_number; if (SLIST_NEXT(periph, periph_links)) @@ -1756,8 +1757,9 @@ xptedtbusfunc(struct cam_eb *bus, void *arg) cdm->matches[j].result.bus_result.bus_id = bus->sim->bus_id; cdm->matches[j].result.bus_result.unit_number = bus->sim->unit_number; - strncpy(cdm->matches[j].result.bus_result.dev_name, - bus->sim->sim_name, DEV_IDLEN); + strlcpy(cdm->matches[j].result.bus_result.dev_name, + bus->sim->sim_name, + sizeof(cdm->matches[j].result.bus_result.dev_name)); } /* @@ -1976,6 +1978,7 @@ xptedtperiphfunc(struct cam_periph *periph, void *arg) */ if (retval & DM_RET_COPY) { int spaceleft, j; + size_t l; spaceleft = cdm->match_buf_len - (cdm->num_matches * sizeof(struct dev_match_result)); @@ -2019,8 +2022,9 @@ xptedtperiphfunc(struct cam_periph *periph, void *arg) periph->path->device->lun_id; cdm->matches[j].result.periph_result.unit_number = periph->unit_number; - strncpy(cdm->matches[j].result.periph_result.periph_name, - periph->periph_name, DEV_IDLEN); + l = sizeof(cdm->matches[j].result.periph_result.periph_name); + strlcpy(cdm->matches[j].result.periph_result.periph_name, + periph->periph_name, l); } return(1); @@ -2115,6 +2119,7 @@ xptplistperiphfunc(struct cam_periph *periph, void *ar */ if (retval & DM_RET_COPY) { int spaceleft, j; + size_t l; spaceleft = cdm->match_buf_len - (cdm->num_matches * sizeof(struct dev_match_result)); @@ -2191,8 +2196,9 @@ xptplistperiphfunc(struct cam_periph *periph, void *ar cdm->matches[j].result.periph_result.unit_number = periph->unit_number; - strncpy(cdm->matches[j].result.periph_result.periph_name, - periph->periph_name, DEV_IDLEN); + l = sizeof(cdm->matches[j].result.periph_result.periph_name); + strlcpy(cdm->matches[j].result.periph_result.periph_name, + periph->periph_name, l); } return(1); @@ -2905,9 +2911,9 @@ call_sim: (nperiph != NULL) && (i <= cgdl->index); nperiph = SLIST_NEXT(nperiph, periph_links), i++) { if (i == cgdl->index) { - strncpy(cgdl->periph_name, + strlcpy(cgdl->periph_name, nperiph->periph_name, - DEV_IDLEN); + sizeof(cgdl->periph_name)); cgdl->unit_number = nperiph->unit_number; found = 1; }