diff options
| author | asomers <asomers@FreeBSD.org> | 2017-12-13 16:20:55 +0000 |
|---|---|---|
| committer | asomers <asomers@FreeBSD.org> | 2017-12-13 16:20:55 +0000 |
| commit | 31b821ae9ff212325b96e89a1c32993979256269 (patch) | |
| tree | 8cb8347fd30397e0faa1630a4d719345097b9c0a /sys/cam | |
| parent | f7eb6f2ac64fcbc8285417a25b0f13fddb0d900c (diff) | |
| download | FreeBSD-src-31b821ae9ff212325b96e89a1c32993979256269.zip FreeBSD-src-31b821ae9ff212325b96e89a1c32993979256269.tar.gz | |
MFC r326100:
Always null-terminate CAM periph_name and dev_name
Reported by: Coverity
CID: 1010039, 1010040, 1010041, 1010043
Reviewed by: ken, imp
Sponsored by: Spectra Logic Corp
Differential Revision: https://reviews.freebsd.org/D13194
Diffstat (limited to 'sys/cam')
| -rw-r--r-- | sys/cam/cam_xpt.c | 26 |
1 files changed, 16 insertions, 10 deletions
diff --git a/sys/cam/cam_xpt.c b/sys/cam/cam_xpt.c index 6d465c5..85aa6b6 100644 --- a/sys/cam/cam_xpt.c +++ b/sys/cam/cam_xpt.c @@ -655,8 +655,9 @@ xptdoioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag, struct thread * /* * Fill in the getdevlist fields. */ - strcpy(ccb->cgdl.periph_name, - periph->periph_name); + strlcpy(ccb->cgdl.periph_name, + periph->periph_name, + sizeof(ccb->cgdl.periph_name)); ccb->cgdl.unit_number = periph->unit_number; if (SLIST_NEXT(periph, periph_links)) @@ -1604,8 +1605,9 @@ xptedtbusfunc(struct cam_eb *bus, void *arg) cdm->matches[j].result.bus_result.bus_id = bus->sim->bus_id; cdm->matches[j].result.bus_result.unit_number = bus->sim->unit_number; - strncpy(cdm->matches[j].result.bus_result.dev_name, - bus->sim->sim_name, DEV_IDLEN); + strlcpy(cdm->matches[j].result.bus_result.dev_name, + bus->sim->sim_name, + sizeof(cdm->matches[j].result.bus_result.dev_name)); } /* @@ -1821,6 +1823,7 @@ xptedtperiphfunc(struct cam_periph *periph, void *arg) */ if (retval & DM_RET_COPY) { int spaceleft, j; + size_t l; spaceleft = cdm->match_buf_len - (cdm->num_matches * sizeof(struct dev_match_result)); @@ -1864,8 +1867,9 @@ xptedtperiphfunc(struct cam_periph *periph, void *arg) periph->path->device->lun_id; cdm->matches[j].result.periph_result.unit_number = periph->unit_number; - strncpy(cdm->matches[j].result.periph_result.periph_name, - periph->periph_name, DEV_IDLEN); + l = sizeof(cdm->matches[j].result.periph_result.periph_name); + strlcpy(cdm->matches[j].result.periph_result.periph_name, + periph->periph_name, l); } return(1); @@ -1960,6 +1964,7 @@ xptplistperiphfunc(struct cam_periph *periph, void *arg) */ if (retval & DM_RET_COPY) { int spaceleft, j; + size_t l; spaceleft = cdm->match_buf_len - (cdm->num_matches * sizeof(struct dev_match_result)); @@ -2036,8 +2041,9 @@ xptplistperiphfunc(struct cam_periph *periph, void *arg) cdm->matches[j].result.periph_result.unit_number = periph->unit_number; - strncpy(cdm->matches[j].result.periph_result.periph_name, - periph->periph_name, DEV_IDLEN); + l = sizeof(cdm->matches[j].result.periph_result.periph_name); + strlcpy(cdm->matches[j].result.periph_result.periph_name, + periph->periph_name, l); } return(1); @@ -2750,9 +2756,9 @@ call_sim: (nperiph != NULL) && (i <= cgdl->index); nperiph = SLIST_NEXT(nperiph, periph_links), i++) { if (i == cgdl->index) { - strncpy(cgdl->periph_name, + strlcpy(cgdl->periph_name, nperiph->periph_name, - DEV_IDLEN); + sizeof(cgdl->periph_name)); cgdl->unit_number = nperiph->unit_number; found = 1; } |
