svn commit: r298665 - head/sys/dev/aacraid
Conrad E. Meyer
cem at FreeBSD.org
Tue Apr 26 20:59:22 UTC 2016
Author: cem
Date: Tue Apr 26 20:59:21 2016
New Revision: 298665
URL: https://svnweb.freebsd.org/changeset/base/298665
Log:
aacraid(4): Fix some mostly trivial buffer overruns
strcpy(3) emits a trailing nul byte, trampling fields after the intended
destination. Instead, use strncpy(3), intentionally leaving these fields
not nul-terminated.
Reported by: Coverity
CIDs: 1031024, 1305463, 1305494, 1305545
Sponsored by: EMC / Isilon Storage Division
Modified:
head/sys/dev/aacraid/aacraid_cam.c
Modified: head/sys/dev/aacraid/aacraid_cam.c
==============================================================================
--- head/sys/dev/aacraid/aacraid_cam.c Tue Apr 26 20:36:32 2016 (r298664)
+++ head/sys/dev/aacraid/aacraid_cam.c Tue Apr 26 20:59:21 2016 (r298665)
@@ -568,9 +568,11 @@ aac_container_special_command(struct cam
p->additional_length = 31;
p->flags = SID_WBus16|SID_Sync|SID_CmdQue;
/* OEM Vendor defines */
- strcpy(p->vendor,"Adaptec ");
- strcpy(p->product,"Array ");
- strcpy(p->revision,"V1.0");
+ strncpy(p->vendor, "Adaptec ", sizeof(p->vendor));
+ strncpy(p->product, "Array ",
+ sizeof(p->product));
+ strncpy(p->revision, "V1.0",
+ sizeof(p->revision));
}
} else {
if (inq->page_code == SVPD_SUPPORTED_PAGE_LIST) {
More information about the svn-src-head
mailing list