Author: cem
Date: Tue Apr 26 20:59:21 2016
New Revision: 298665
URL: https://svnweb.freebsd.org/changeset/base/298665
Log:
aacraid(4): Fix some mostly trivial buffer overruns
strcpy(3) emits a trailing nul byte, trampling fields after the intended
destination. Instead, use strncpy(3), intentionally leaving these fields
not nul-terminated.
Reported by: Coverity
CIDs: 1031024, 1305463, 1305494, 1305545
Sponsored by: EMC / Isilon Storage Division
Modified:
head/sys/dev/aacraid/aacraid_cam.c
Modified: head/sys/dev/aacraid/aacraid_cam.c
==============================================================================
--- head/sys/dev/aacraid/aacraid_cam.c Tue Apr 26 20:36:32 2016
(r298664)
+++ head/sys/dev/aacraid/aacraid_cam.c Tue Apr 26 20:59:21 2016
(r298665)
@@ -568,9 +568,11 @@ aac_container_special_command(struct cam
p->additional_length = 31;
p->flags = SID_WBus16|SID_Sync|SID_CmdQue;
/* OEM Vendor defines */
- strcpy(p->vendor,"Adaptec ");
- strcpy(p->product,"Array ");
- strcpy(p->revision,"V1.0");
+ strncpy(p->vendor, "Adaptec ",
sizeof(p->vendor));
+ strncpy(p->product, "Array ",
+ sizeof(p->product));
+ strncpy(p->revision, "V1.0",
+ sizeof(p->revision));
}
} else {
if (inq->page_code == SVPD_SUPPORTED_PAGE_LIST) {
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
