[dpdk-dev] [PATCH 2/2] examples/vhost_scsi: fix potential buffer overrun with safe copy API

[Changpeng Liu]

Signed-off-by: Changpeng Liu <changpeng....@intel.com>
---
 examples/vhost_scsi/scsi.c       | 23 ++++++++++++-----------
 examples/vhost_scsi/vhost_scsi.c |  5 +++--
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/examples/vhost_scsi/scsi.c b/examples/vhost_scsi/scsi.c
index 0c2fa3e..1572098 100644
--- a/examples/vhost_scsi/scsi.c
+++ b/examples/vhost_scsi/scsi.c
@@ -182,8 +182,8 @@
                        break;
                case SPC_VPD_UNIT_SERIAL_NUMBER:
                        hlen = 4;
-                       strlcpy((char *)vpage->params, bdev->name,
-                                       sizeof(vpage->params));
+                       vhost_strcpy_pad((char *)vpage->params, bdev->name,
+                                       sizeof(vpage->params), ' ');
                        vpage->alloc_len = rte_cpu_to_be_16(32);
                        break;
                case SPC_VPD_DEVICE_IDENTIFICATION:
@@ -217,10 +217,11 @@
                        desig->piv = 1;
                        desig->reserved1 = 0;
                        desig->len = 8 + 16 + 32;
-                       strlcpy((char *)desig->desig, "INTEL", 8);
+                       vhost_strcpy_pad((char *)desig->desig, "INTEL", 8, ' ');
                        vhost_strcpy_pad((char *)&desig->desig[8],
                                         bdev->product_name, 16, ' ');
-                       strlcpy((char *)&desig->desig[24], bdev->name, 32);
+                       vhost_strcpy_pad((char *)&desig->desig[24], bdev->name,
+                                       32, ' ');
                        len += sizeof(struct scsi_desig_desc) + 8 + 16 + 32;
 
                        buf += sizeof(struct scsi_desig_desc) + desig->len;
@@ -277,17 +278,17 @@
                inqdata->flags3 = 0x2;
 
                /* T10 VENDOR IDENTIFICATION */
-               strlcpy((char *)inqdata->t10_vendor_id, "INTEL",
-                       sizeof(inqdata->t10_vendor_id));
+               vhost_strcpy_pad((char *)inqdata->t10_vendor_id, "INTEL",
+                       sizeof(inqdata->t10_vendor_id), ' ');
 
                /* PRODUCT IDENTIFICATION */
-               snprintf((char *)inqdata->product_id,
-                               RTE_DIM(inqdata->product_id), "%s",
-                               bdev->product_name);
+               vhost_strcpy_pad((char *)inqdata->product_id,
+                               bdev->product_name,
+                               sizeof(inqdata->product_id), ' ');
 
                /* PRODUCT REVISION LEVEL */
-               strlcpy((char *)inqdata->product_rev, "0001",
-                       sizeof(inqdata->product_rev));
+               vhost_strcpy_pad((char *)inqdata->product_rev, "0001",
+                       sizeof(inqdata->product_rev), ' ');
 
                /* Standard inquiry data ends here. Only populate
                 * remaining fields if alloc_len indicates enough
diff --git a/examples/vhost_scsi/vhost_scsi.c b/examples/vhost_scsi/vhost_scsi.c
index a1d542b..4e57462 100644
--- a/examples/vhost_scsi/vhost_scsi.c
+++ b/examples/vhost_scsi/vhost_scsi.c
@@ -183,8 +183,9 @@ static uint64_t gpa_to_vva(int vid, uint64_t gpa, uint64_t 
*len)
        if (!bdev)
                return NULL;
 
-       strncpy(bdev->name, bdev_name, sizeof(bdev->name));
-       strncpy(bdev->product_name, bdev_serial, sizeof(bdev->product_name));
+       snprintf(bdev->name, sizeof(bdev->name), "%s", bdev_name);
+       snprintf(bdev->product_name, sizeof(bdev->product_name),
+               "%s", bdev_serial);
        bdev->blocklen = blk_size;
        bdev->blockcnt = blk_cnt;
        bdev->write_cache = wce_enable;
-- 
1.9.3