lkml.org 
[lkml]   [2012]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[Suggestion] drivers/staging/tidspbridge: strcpy and strncpy, src length checking issue.
Hello Omar Ramirez Luna:

in drivers/staging/tidspbridge/rmgr/proc.c:

if strlen(drv_datap->base_img) == size, will pass checking (line 397)
the size is the full length of exec_file (line 382, line 468..469)
strcpy causes issue: src len is strlen(drv_datap->base_img) + '\0'. (line 400)

strncpy seems also has issue: need use size instead of strlen(iva_img) + 1. (line 402..403)

please help to check, thanks.

gchen.


380 static int get_exec_file(struct cfg_devnode *dev_node_obj,
381 struct dev_object *hdev_obj,
382 u32 size, char *exec_file)
383 {
384 u8 dev_type;
385 s32 len;
386 struct drv_data *drv_datap = dev_get_drvdata(bridge);
387
388 dev_get_dev_type(hdev_obj, (u8 *) &dev_type);
389
390 if (!exec_file)
391 return -EFAULT;
392
393 if (dev_type == DSP_UNIT) {
394 if (!drv_datap || !drv_datap->base_img)
395 return -EFAULT;
396
397 if (strlen(drv_datap->base_img) > size)
398 return -EINVAL;
399
400 strcpy(exec_file, drv_datap->base_img);
401 } else if (dev_type == IVA_UNIT && iva_img) {
402 len = strlen(iva_img);
403 strncpy(exec_file, iva_img, len + 1);
404 } else {
405 return -ENOENT;
406 }
407
408 return 0;
409 }
410
...

465 /* Get the default executable for this board... */
466 dev_get_dev_type(hdev_obj, (u8 *) &dev_type);
467 p_proc_object->processor_id = dev_type;
468 status = get_exec_file(dev_node_obj, hdev_obj, sizeof(sz_exec_file),
469 sz_exec_file);



\
 
 \ /
  Last update: 2012-12-14 05:21    [W:0.215 / U:0.856 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site