Date: Wed, 13 Dec 2017 16:20:55 +0000 (UTC) From: Alan Somers <asomers@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r326826 - stable/11/sys/cam Message-ID: <201712131620.vBDGKtgw049609@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: asomers Date: Wed Dec 13 16:20:55 2017 New Revision: 326826 URL: https://svnweb.freebsd.org/changeset/base/326826 Log: MFC r326100: Always null-terminate CAM periph_name and dev_name Reported by: Coverity CID: 1010039, 1010040, 1010041, 1010043 Reviewed by: ken, imp Sponsored by: Spectra Logic Corp Differential Revision: https://reviews.freebsd.org/D13194 Modified: stable/11/sys/cam/cam_xpt.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/cam/cam_xpt.c ============================================================================== --- stable/11/sys/cam/cam_xpt.c Wed Dec 13 16:17:37 2017 (r326825) +++ stable/11/sys/cam/cam_xpt.c Wed Dec 13 16:20:55 2017 (r326826) @@ -655,8 +655,9 @@ xptdoioctl(struct cdev *dev, u_long cmd, caddr_t addr, /* * Fill in the getdevlist fields. */ - strcpy(ccb->cgdl.periph_name, - periph->periph_name); + strlcpy(ccb->cgdl.periph_name, + periph->periph_name, + sizeof(ccb->cgdl.periph_name)); ccb->cgdl.unit_number = periph->unit_number; if (SLIST_NEXT(periph, periph_links)) @@ -1604,8 +1605,9 @@ xptedtbusfunc(struct cam_eb *bus, void *arg) cdm->matches[j].result.bus_result.bus_id = bus->sim->bus_id; cdm->matches[j].result.bus_result.unit_number = bus->sim->unit_number; - strncpy(cdm->matches[j].result.bus_result.dev_name, - bus->sim->sim_name, DEV_IDLEN); + strlcpy(cdm->matches[j].result.bus_result.dev_name, + bus->sim->sim_name, + sizeof(cdm->matches[j].result.bus_result.dev_name)); } /* @@ -1821,6 +1823,7 @@ xptedtperiphfunc(struct cam_periph *periph, void *arg) */ if (retval & DM_RET_COPY) { int spaceleft, j; + size_t l; spaceleft = cdm->match_buf_len - (cdm->num_matches * sizeof(struct dev_match_result)); @@ -1864,8 +1867,9 @@ xptedtperiphfunc(struct cam_periph *periph, void *arg) periph->path->device->lun_id; cdm->matches[j].result.periph_result.unit_number = periph->unit_number; - strncpy(cdm->matches[j].result.periph_result.periph_name, - periph->periph_name, DEV_IDLEN); + l = sizeof(cdm->matches[j].result.periph_result.periph_name); + strlcpy(cdm->matches[j].result.periph_result.periph_name, + periph->periph_name, l); } return(1); @@ -1960,6 +1964,7 @@ xptplistperiphfunc(struct cam_periph *periph, void *ar */ if (retval & DM_RET_COPY) { int spaceleft, j; + size_t l; spaceleft = cdm->match_buf_len - (cdm->num_matches * sizeof(struct dev_match_result)); @@ -2036,8 +2041,9 @@ xptplistperiphfunc(struct cam_periph *periph, void *ar cdm->matches[j].result.periph_result.unit_number = periph->unit_number; - strncpy(cdm->matches[j].result.periph_result.periph_name, - periph->periph_name, DEV_IDLEN); + l = sizeof(cdm->matches[j].result.periph_result.periph_name); + strlcpy(cdm->matches[j].result.periph_result.periph_name, + periph->periph_name, l); } return(1); @@ -2750,9 +2756,9 @@ call_sim: (nperiph != NULL) && (i <= cgdl->index); nperiph = SLIST_NEXT(nperiph, periph_links), i++) { if (i == cgdl->index) { - strncpy(cgdl->periph_name, + strlcpy(cgdl->periph_name, nperiph->periph_name, - DEV_IDLEN); + sizeof(cgdl->periph_name)); cgdl->unit_number = nperiph->unit_number; found = 1; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201712131620.vBDGKtgw049609>