* [PATCH v2] mdadm: fix a buffer overflow
@ 2016-09-08 0:43 Song Liu
2016-09-08 17:56 ` Shaohua Li
0 siblings, 1 reply; 3+ messages in thread
From: Song Liu @ 2016-09-08 0:43 UTC (permalink / raw)
To: linux-raid; +Cc: Jes.Sorensen, shli, Song Liu
struct mdp_superblock_1.set_name is 32B long, but struct mdinfo.name
is 33B long. So we need strncpy instead strcpy to avoid buffer
overflow.
Signed-off-by: Song Liu <songliubraving@fb.com>
---
super1.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/super1.c b/super1.c
index f3e4023..46fed54 100644
--- a/super1.c
+++ b/super1.c
@@ -1294,7 +1294,7 @@ static int update_super1(struct supertype *st, struct mdinfo *info,
strcat(sb->set_name, ":");
strcat(sb->set_name, info->name);
} else
- strcpy(sb->set_name, info->name);
+ strncpy(sb->set_name, info->name, 32);
} else if (strcmp(update, "devicesize") == 0 &&
__le64_to_cpu(sb->super_offset) <
__le64_to_cpu(sb->data_offset)) {
@@ -1444,7 +1444,7 @@ static int init_super1(struct supertype *st, mdu_array_info_t *info,
strcat(sb->set_name, ":");
strcat(sb->set_name, name);
} else
- strcpy(sb->set_name, name);
+ strncpy(sb->set_name, name, 32);
sb->ctime = __cpu_to_le64((unsigned long long)time(0));
sb->level = __cpu_to_le32(info->level);
--
2.8.0.rc2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] mdadm: fix a buffer overflow
2016-09-08 0:43 [PATCH v2] mdadm: fix a buffer overflow Song Liu
@ 2016-09-08 17:56 ` Shaohua Li
2016-09-08 18:20 ` Song Liu
0 siblings, 1 reply; 3+ messages in thread
From: Shaohua Li @ 2016-09-08 17:56 UTC (permalink / raw)
To: Song Liu; +Cc: linux-raid, Jes.Sorensen, shli
On Wed, Sep 07, 2016 at 05:43:35PM -0700, Song Liu wrote:
> struct mdp_superblock_1.set_name is 32B long, but struct mdinfo.name
> is 33B long. So we need strncpy instead strcpy to avoid buffer
> overflow.
>
> Signed-off-by: Song Liu <songliubraving@fb.com>
> ---
> super1.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/super1.c b/super1.c
> index f3e4023..46fed54 100644
> --- a/super1.c
> +++ b/super1.c
> @@ -1294,7 +1294,7 @@ static int update_super1(struct supertype *st, struct mdinfo *info,
> strcat(sb->set_name, ":");
> strcat(sb->set_name, info->name);
> } else
> - strcpy(sb->set_name, info->name);
> + strncpy(sb->set_name, info->name, 32);
strncpy(sb->set_name, info->name, sizeof(sb->set_name)); ?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] mdadm: fix a buffer overflow
2016-09-08 17:56 ` Shaohua Li
@ 2016-09-08 18:20 ` Song Liu
0 siblings, 0 replies; 3+ messages in thread
From: Song Liu @ 2016-09-08 18:20 UTC (permalink / raw)
To: Shaohua Li
Cc: linux-raid@vger.kernel.org, Jes.Sorensen@redhat.com, Shaohua Li
Sounds good. Let me resend.
Thanks,
Song
>> On 9/8/16, 10:56 AM, "Shaohua Li" <shli@kernel.org> wrote:
On Wed, Sep 07, 2016 at 05:43:35PM -0700, Song Liu wrote:
> struct mdp_superblock_1.set_name is 32B long, but struct mdinfo.name
> is 33B long. So we need strncpy instead strcpy to avoid buffer
> overflow.
>
> Signed-off-by: Song Liu <songliubraving@fb.com>
> ---
> super1.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/super1.c b/super1.c
> index f3e4023..46fed54 100644
> --- a/super1.c
> +++ b/super1.c
> @@ -1294,7 +1294,7 @@ static int update_super1(struct supertype *st, struct mdinfo *info,
> strcat(sb->set_name, ":");
> strcat(sb->set_name, info->name);
> } else
> - strcpy(sb->set_name, info->name);
> + strncpy(sb->set_name, info->name, 32);
strncpy(sb->set_name, info->name, sizeof(sb->set_name)); ?
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-09-08 18:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-09-08 0:43 [PATCH v2] mdadm: fix a buffer overflow Song Liu
2016-09-08 17:56 ` Shaohua Li
2016-09-08 18:20 ` Song Liu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.