Date: Tue, 26 Apr 2016 20:59:21 +0000 (UTC) From: "Conrad E. Meyer" <cem@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r298665 - head/sys/dev/aacraid Message-ID: <201604262059.u3QKxLDl045059@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cem Date: Tue Apr 26 20:59:21 2016 New Revision: 298665 URL: https://svnweb.freebsd.org/changeset/base/298665 Log: aacraid(4): Fix some mostly trivial buffer overruns strcpy(3) emits a trailing nul byte, trampling fields after the intended destination. Instead, use strncpy(3), intentionally leaving these fields not nul-terminated. Reported by: Coverity CIDs: 1031024, 1305463, 1305494, 1305545 Sponsored by: EMC / Isilon Storage Division Modified: head/sys/dev/aacraid/aacraid_cam.c Modified: head/sys/dev/aacraid/aacraid_cam.c ============================================================================== --- head/sys/dev/aacraid/aacraid_cam.c Tue Apr 26 20:36:32 2016 (r298664) +++ head/sys/dev/aacraid/aacraid_cam.c Tue Apr 26 20:59:21 2016 (r298665) @@ -568,9 +568,11 @@ aac_container_special_command(struct cam p->additional_length = 31; p->flags = SID_WBus16|SID_Sync|SID_CmdQue; /* OEM Vendor defines */ - strcpy(p->vendor,"Adaptec "); - strcpy(p->product,"Array "); - strcpy(p->revision,"V1.0"); + strncpy(p->vendor, "Adaptec ", sizeof(p->vendor)); + strncpy(p->product, "Array ", + sizeof(p->product)); + strncpy(p->revision, "V1.0", + sizeof(p->revision)); } } else { if (inq->page_code == SVPD_SUPPORTED_PAGE_LIST) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201604262059.u3QKxLDl045059>