* [PATCH] staging: fbtft: Fix buffer overflow vulnerability
@ 2017-02-15 0:42 Tobin C. Harding
2017-02-15 1:02 ` Greg Kroah-Hartman
0 siblings, 1 reply; 2+ messages in thread
From: Tobin C. Harding @ 2017-02-15 0:42 UTC (permalink / raw)
To: Thomas Petazzoni, noralf
Cc: Greg Kroah-Hartman, devel, linux-kernel, Tobin C. Harding
Module copies a user supplied string (module parameter) into a buffer
using strncpy() and does not check that the buffer is null terminated.
Replace call to strncpy() with call to strlcpy() ensuring that the
buffer is null terminated.
Signed-off-by: Tobin C. Harding <me@tobin.cc>
---
drivers/staging/fbtft/fbtft_device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/fbtft/fbtft_device.c b/drivers/staging/fbtft/fbtft_device.c
index de46f8d..7b7223b 100644
--- a/drivers/staging/fbtft/fbtft_device.c
+++ b/drivers/staging/fbtft/fbtft_device.c
@@ -1483,7 +1483,7 @@ static int __init fbtft_device_init(void)
displays[i].pdev->name = name;
displays[i].spi = NULL;
} else {
- strncpy(displays[i].spi->modalias, name, SPI_NAME_SIZE);
+ strlcpy(displays[i].spi->modalias, name, SPI_NAME_SIZE);
displays[i].pdev = NULL;
}
}
--
2.7.4
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] staging: fbtft: Fix buffer overflow vulnerability
2017-02-15 0:42 [PATCH] staging: fbtft: Fix buffer overflow vulnerability Tobin C. Harding
@ 2017-02-15 1:02 ` Greg Kroah-Hartman
0 siblings, 0 replies; 2+ messages in thread
From: Greg Kroah-Hartman @ 2017-02-15 1:02 UTC (permalink / raw)
To: Tobin C. Harding; +Cc: Thomas Petazzoni, noralf, devel, linux-kernel
On Wed, Feb 15, 2017 at 11:42:54AM +1100, Tobin C. Harding wrote:
> Module copies a user supplied string (module parameter) into a buffer
> using strncpy() and does not check that the buffer is null terminated.
>
> Replace call to strncpy() with call to strlcpy() ensuring that the
> buffer is null terminated.
>
> Signed-off-by: Tobin C. Harding <me@tobin.cc>
> ---
> drivers/staging/fbtft/fbtft_device.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/fbtft/fbtft_device.c b/drivers/staging/fbtft/fbtft_device.c
> index de46f8d..7b7223b 100644
> --- a/drivers/staging/fbtft/fbtft_device.c
> +++ b/drivers/staging/fbtft/fbtft_device.c
> @@ -1483,7 +1483,7 @@ static int __init fbtft_device_init(void)
> displays[i].pdev->name = name;
> displays[i].spi = NULL;
> } else {
> - strncpy(displays[i].spi->modalias, name, SPI_NAME_SIZE);
> + strlcpy(displays[i].spi->modalias, name, SPI_NAME_SIZE);
Shouldn't we properly check the return value here to know if the buffer
did get truncated? Or do we really care?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-02-15 1:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-15 0:42 [PATCH] staging: fbtft: Fix buffer overflow vulnerability Tobin C. Harding
2017-02-15 1:02 ` Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®