On Wed, Sep 11, 2019 at 07:57:49AM +0200, Sandro Volery wrote: > Replaced strcpy with strscpy in exfat_core.c. > > Signed-off-by: Sandro Volery <san...@volery.com> > --- > drivers/staging/exfat/exfat_core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/exfat/exfat_core.c > b/drivers/staging/exfat/exfat_core.c > index da8c58149c35..c71b145e8a24 100644 > --- a/drivers/staging/exfat/exfat_core.c > +++ b/drivers/staging/exfat/exfat_core.c > @@ -2964,7 +2964,7 @@ s32 resolve_path(struct inode *inode, char *path, > struct chain_t *p_dir, > if (strlen(path) >= (MAX_NAME_LENGTH * MAX_CHARSET_SIZE)) > return FFS_INVALIDPATH; > > - strcpy(name_buf, path); > + strscpy(name_buf, path, sizeof(name_buf));
It checked strlen() earlier so we know that it can't overflow but, oh wow, the "name_buf" is a shared buffer. wow wow wow. This seems very racy. regards, dan carpenter _______________________________________________ devel mailing list de...@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
