diff options
author | Taro Yamada | 2016-12-13 05:18:28 -0600 |
---|---|---|
committer | Emil Velikov | 2017-01-16 08:41:36 -0600 |
commit | 4ecd1ef010beadef05f7c63c4546849b2eb5ac15 (patch) | |
tree | e4df52d4af35c3bf26fdc9620d600b2fa1412ed0 | |
parent | 44f220ad6200dbccebea2287b874fda7665efe4d (diff) | |
download | external-libdrm-4ecd1ef010beadef05f7c63c4546849b2eb5ac15.tar.gz external-libdrm-4ecd1ef010beadef05f7c63c4546849b2eb5ac15.tar.xz external-libdrm-4ecd1ef010beadef05f7c63c4546849b2eb5ac15.zip |
xf86drm: fix null termination of string buffer
The string written to the buffer by read() is not null-terminated,
but currently drmParsePciBusInfo() places null character only at the end of the buffer, not at the end of the
string.
As a result, the string passed to sscanf() contains an uninitialized value.
This patch changes to places null character at the end of the string.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99045
Signed-off-by: Taro Yamada <archer_ame@yahoo.co.jp>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
-rw-r--r-- | configure.ac | 2 | ||||
-rw-r--r-- | xf86drm.c | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/configure.ac b/configure.ac index e0597c35..39973b62 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -61,7 +61,7 @@ LT_PREREQ([2.2]) | |||
61 | LT_INIT([disable-static]) | 61 | LT_INIT([disable-static]) |
62 | 62 | ||
63 | 63 | ||
64 | PKG_CHECK_MODULES(PTHREADSTUBS, pthread-stubs) | 64 | |
65 | AC_SUBST(PTHREADSTUBS_CFLAGS) | 65 | AC_SUBST(PTHREADSTUBS_CFLAGS) |
66 | AC_SUBST(PTHREADSTUBS_LIBS) | 66 | AC_SUBST(PTHREADSTUBS_LIBS) |
67 | 67 | ||
@@ -2929,11 +2929,11 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info) | |||
2929 | if (fd < 0) | 2929 | if (fd < 0) |
2930 | return -errno; | 2930 | return -errno; |
2931 | 2931 | ||
2932 | ret = read(fd, data, sizeof(data)); | 2932 | ret = read(fd, data, sizeof(data)-1); |
2933 | data[sizeof(data)-1] = '\0'; | ||
2934 | close(fd); | 2933 | close(fd); |
2935 | if (ret < 0) | 2934 | if (ret < 0) |
2936 | return -errno; | 2935 | return -errno; |
2936 | data[ret] = '\0'; | ||
2937 | 2937 | ||
2938 | #define TAG "PCI_SLOT_NAME=" | 2938 | #define TAG "PCI_SLOT_NAME=" |
2939 | str = strstr(data, TAG); | 2939 | str = strstr(data, TAG); |