On Mon, Oct 23, 2017 at 12:24:49PM +0100, Kirill Rybalchenko wrote:
> num parameter for strncpy() function should be smaller than
> actual destination buffer size to allow null termination.
>
> Fixes: 40d1324423a4 ("net/i40e: get ddp profile protocol info")
>
> Signed-off-by: Kirill Rybalchenko <kirill.rybalche...@intel.com>
> ---
> drivers/net/i40e/rte_pmd_i40e.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/i40e/rte_pmd_i40e.c b/drivers/net/i40e/rte_pmd_i40e.c
> index 4881ea0..489f66b 100644
> --- a/drivers/net/i40e/rte_pmd_i40e.c
> +++ b/drivers/net/i40e/rte_pmd_i40e.c
> @@ -1928,7 +1928,7 @@ int rte_pmd_i40e_get_ddp_info(uint8_t *pkg_buff,
> uint32_t pkg_size,
> for (i = j = 0; i < nb_rec; j++) {
> pinfo[j].proto_id = tlv->data[0];
> strncpy(pinfo[j].name, (const char *)&tlv->data[1],
> - I40E_DDP_NAME_SIZE);
> + I40E_DDP_NAME_SIZE - 1);
> i += tlv->len;
> tlv = &tlv[tlv->len];
> }
> --
This is not a proper fix, as it still won't null-terminate the result.
Replace strncpy with snprintf is probably the best solution.
/Bruce
