summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTaro Yamada2016-12-13 05:18:28 -0600
committerEmil Velikov2017-01-16 08:41:36 -0600
commit4ecd1ef010beadef05f7c63c4546849b2eb5ac15 (patch)
treee4df52d4af35c3bf26fdc9620d600b2fa1412ed0
parent44f220ad6200dbccebea2287b874fda7665efe4d (diff)
downloadexternal-libdrm-4ecd1ef010beadef05f7c63c4546849b2eb5ac15.tar.gz
external-libdrm-4ecd1ef010beadef05f7c63c4546849b2eb5ac15.tar.xz
external-libdrm-4ecd1ef010beadef05f7c63c4546849b2eb5ac15.zip
xf86drm: fix null termination of string buffer
The string written to the buffer by read() is not null-terminated, but currently drmParsePciBusInfo() places null character only at the end of the buffer, not at the end of the string. As a result, the string passed to sscanf() contains an uninitialized value. This patch changes to places null character at the end of the string. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99045 Signed-off-by: Taro Yamada <archer_ame@yahoo.co.jp> Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
-rw-r--r--configure.ac2
-rw-r--r--xf86drm.c4
2 files changed, 3 insertions, 3 deletions
diff --git a/configure.ac b/configure.ac
index e0597c35..39973b62 100644
--- a/configure.ac
+++ b/configure.ac
@@ -61,7 +61,7 @@ LT_PREREQ([2.2])
61LT_INIT([disable-static]) 61LT_INIT([disable-static])
62 62
63 63
64PKG_CHECK_MODULES(PTHREADSTUBS, pthread-stubs) 64
65AC_SUBST(PTHREADSTUBS_CFLAGS) 65AC_SUBST(PTHREADSTUBS_CFLAGS)
66AC_SUBST(PTHREADSTUBS_LIBS) 66AC_SUBST(PTHREADSTUBS_LIBS)
67 67
diff --git a/xf86drm.c b/xf86drm.c
index b8b2cfe5..7b78dc6b 100644
--- a/xf86drm.c
+++ b/xf86drm.c
@@ -2929,11 +2929,11 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info)
2929 if (fd < 0) 2929 if (fd < 0)
2930 return -errno; 2930 return -errno;
2931 2931
2932 ret = read(fd, data, sizeof(data)); 2932 ret = read(fd, data, sizeof(data)-1);
2933 data[sizeof(data)-1] = '\0';
2934 close(fd); 2933 close(fd);
2935 if (ret < 0) 2934 if (ret < 0)
2936 return -errno; 2935 return -errno;
2936 data[ret] = '\0';
2937 2937
2938#define TAG "PCI_SLOT_NAME=" 2938#define TAG "PCI_SLOT_NAME="
2939 str = strstr(data, TAG); 2939 str = strstr(data, TAG);