Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 13 May 2016 09:06:52 +0000 (UTC)
From:      Garrett Cooper <ngie@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r299635 - stable/10/sys/dev/aacraid
Message-ID:  <201605130906.u4D96qh8075210@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: ngie
Date: Fri May 13 09:06:52 2016
New Revision: 299635
URL: https://svnweb.freebsd.org/changeset/base/299635

Log:
  MFC r298665:
  r298665 (by cem):
  
  aacraid(4): Fix some mostly trivial buffer overruns
  
  strcpy(3) emits a trailing nul byte, trampling fields after the intended
  destination.  Instead, use strncpy(3), intentionally leaving these fields
  not nul-terminated.
  
  CIDs:		1031024, 1305463, 1305494, 1305545

Modified:
  stable/10/sys/dev/aacraid/aacraid_cam.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/dev/aacraid/aacraid_cam.c
==============================================================================
--- stable/10/sys/dev/aacraid/aacraid_cam.c	Fri May 13 09:05:29 2016	(r299634)
+++ stable/10/sys/dev/aacraid/aacraid_cam.c	Fri May 13 09:06:52 2016	(r299635)
@@ -570,9 +570,11 @@ aac_container_special_command(struct cam
 				p->additional_length = 31;
 				p->flags = SID_WBus16|SID_Sync|SID_CmdQue;
 				/* OEM Vendor defines */
-				strcpy(p->vendor,"Adaptec ");
-				strcpy(p->product,"Array           ");
-				strcpy(p->revision,"V1.0");
+				strncpy(p->vendor, "Adaptec ", sizeof(p->vendor));
+				strncpy(p->product, "Array           ",
+				    sizeof(p->product));
+				strncpy(p->revision, "V1.0",
+				    sizeof(p->revision));
 			}	
 		} else {
 			if (inq->page_code == SVPD_SUPPORTED_PAGE_LIST) {



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605130906.u4D96qh8075210>