Date: Tue, 1 Sep 2020 14:52:35 +0000 (UTC) From: Edward Tomasz Napierala <trasz@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r365040 - head/usr.sbin/iscsid Message-ID: <202009011452.081EqZc7081012@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: trasz Date: Tue Sep 1 14:52:35 2020 New Revision: 365040 URL: https://svnweb.freebsd.org/changeset/base/365040 Log: Fix string overflow that could occur during redirection due to passing the wrong length to strlcpy(3). It looks like it could overflow into the next field, isc_user, which is properly long to accomodate for it; I don't think it could cause any harm other than breaking the connection. Reviewed by: mav MFC after: 2 weeks Sponsored by: NetApp, Inc. Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D26247 Modified: head/usr.sbin/iscsid/login.c Modified: head/usr.sbin/iscsid/login.c ============================================================================== --- head/usr.sbin/iscsid/login.c Tue Sep 1 14:50:43 2020 (r365039) +++ head/usr.sbin/iscsid/login.c Tue Sep 1 14:52:35 2020 (r365040) @@ -170,7 +170,7 @@ kernel_modify(const struct connection *conn, const cha ism.ism_session_id = conn->conn_session_id; memcpy(&ism.ism_conf, &conn->conn_conf, sizeof(ism.ism_conf)); strlcpy(ism.ism_conf.isc_target_addr, target_address, - sizeof(ism.ism_conf.isc_target)); + sizeof(ism.ism_conf.isc_target_addr)); error = ioctl(conn->conn_iscsi_fd, ISCSISMODIFY, &ism); if (error != 0) { log_err(1, "failed to redirect to %s: ISCSISMODIFY",
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202009011452.081EqZc7081012>