summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDamien Lespiau <damien.lespiau@intel.com>2016-01-22 12:41:55 +0000
committerDamien Lespiau <damien.lespiau@intel.com>2016-01-22 15:50:17 +0000
commit3627f38da9fad7db7fef2a0c6d0faf706c2e21d6 (patch)
tree9f6ac75c68545653ddbb93c2110890e9b1cd8776
parentdb138b9ba12a0de5d6140832c0679c2418e3e7e0 (diff)
downloadlibdrm-3627f38da9fad7db7fef2a0c6d0faf706c2e21d6.tar.gz
libdrm-3627f38da9fad7db7fef2a0c6d0faf706c2e21d6.tar.xz
xf86drm: Bound strstr() to the allocated data
We are reading at most sizeof(data) bytes, but then data may not contain a terminating '\0', at least in theory, so strstr() may overflow the stack allocated array. Make sure that data always contains at least one '\0'. Signed-off-by: Damien Lespiau <damien.lespiau@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
-rw-r--r--xf86drm.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/xf86drm.c b/xf86drm.c
index 7e28b4f..5f587d9 100644
--- a/xf86drm.c
+++ b/xf86drm.c
@@ -2863,7 +2863,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info)
{
#ifdef __linux__
char path[PATH_MAX + 1];
- char data[128];
+ char data[128 + 1];
char *str;
int domain, bus, dev, func;
int fd, ret;
@@ -2874,6 +2874,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info)
return -errno;
ret = read(fd, data, sizeof(data));
+ data[128] = '\0';
close(fd);
if (ret < 0)
return -errno;