aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDamien Lespiau2016-01-22 06:41:55 -0600
committerDamien Lespiau2016-01-22 09:50:17 -0600
commit3627f38da9fad7db7fef2a0c6d0faf706c2e21d6 (patch)
tree9f6ac75c68545653ddbb93c2110890e9b1cd8776 /xf86drm.c
parentdb138b9ba12a0de5d6140832c0679c2418e3e7e0 (diff)
downloadexternal-libgbm-3627f38da9fad7db7fef2a0c6d0faf706c2e21d6.tar.gz
external-libgbm-3627f38da9fad7db7fef2a0c6d0faf706c2e21d6.tar.xz
external-libgbm-3627f38da9fad7db7fef2a0c6d0faf706c2e21d6.zip
xf86drm: Bound strstr() to the allocated data
We are reading at most sizeof(data) bytes, but then data may not contain a terminating '\0', at least in theory, so strstr() may overflow the stack allocated array. Make sure that data always contains at least one '\0'. Signed-off-by: Damien Lespiau <damien.lespiau@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Diffstat (limited to 'xf86drm.c')
-rw-r--r--xf86drm.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/xf86drm.c b/xf86drm.c
index 7e28b4f7..5f587d96 100644
--- a/xf86drm.c
+++ b/xf86drm.c
@@ -2863,7 +2863,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info)
2863{ 2863{
2864#ifdef __linux__ 2864#ifdef __linux__
2865 char path[PATH_MAX + 1]; 2865 char path[PATH_MAX + 1];
2866 char data[128]; 2866 char data[128 + 1];
2867 char *str; 2867 char *str;
2868 int domain, bus, dev, func; 2868 int domain, bus, dev, func;
2869 int fd, ret; 2869 int fd, ret;
@@ -2874,6 +2874,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info)
2874 return -errno; 2874 return -errno;
2875 2875
2876 ret = read(fd, data, sizeof(data)); 2876 ret = read(fd, data, sizeof(data));
2877 data[128] = '\0';
2877 close(fd); 2878 close(fd);
2878 if (ret < 0) 2879 if (ret < 0)
2879 return -errno; 2880 return -errno;