All of lore.kernel.org
 help / color / mirror / Atom feed
From: Kevin Wolf <kwolf@redhat.com>
To: qemu-block@nongnu.org
Cc: kwolf@redhat.com, qemu-devel@nongnu.org
Subject: [PULL 3/7] libvduse: Replace strcpy() with strncpy()
Date: Tue,  2 Aug 2022 15:37:53 +0200	[thread overview]
Message-ID: <20220802133757.138016-4-kwolf@redhat.com> (raw)
In-Reply-To: <20220802133757.138016-1-kwolf@redhat.com>

From: Xie Yongji <xieyongji@bytedance.com>

Coverity reported a string overflow issue since we copied
"name" to "dev_config->name" without checking the length.
This should be a false positive since we already checked
the length of "name" in vduse_name_is_invalid(). But anyway,
let's replace strcpy() with strncpy() (as a general library,
we'd like to minimize dependencies on other libraries, so we
didn't use g_strlcpy() here) to fix the coverity complaint.

Fixes: Coverity CID 1490224
Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20220706095624.328-3-xieyongji@bytedance.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 subprojects/libvduse/libvduse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/subprojects/libvduse/libvduse.c b/subprojects/libvduse/libvduse.c
index 6374933881..1e36227388 100644
--- a/subprojects/libvduse/libvduse.c
+++ b/subprojects/libvduse/libvduse.c
@@ -1309,7 +1309,8 @@ VduseDev *vduse_dev_create(const char *name, uint32_t device_id,
         goto err_dev;
     }
 
-    strcpy(dev_config->name, name);
+    strncpy(dev_config->name, name, VDUSE_NAME_MAX);
+    dev_config->name[VDUSE_NAME_MAX - 1] = '\0';
     dev_config->device_id = device_id;
     dev_config->vendor_id = vendor_id;
     dev_config->features = features;
-- 
2.35.3



  parent reply	other threads:[~2022-08-02 13:45 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-02 13:37 [PULL 0/7] Block layer patches Kevin Wolf
2022-08-02 13:37 ` [PULL 1/7] block/io_uring: add missing include file Kevin Wolf
2022-08-02 13:37 ` [PULL 2/7] libvduse: Fix the incorrect function name Kevin Wolf
2022-08-02 13:37 ` Kevin Wolf [this message]
2022-08-02 13:37 ` [PULL 4/7] libvduse: Pass positive value to strerror() Kevin Wolf
2022-08-02 13:37 ` [PULL 5/7] hw/block/hd-geometry: Do not override specified bios-chs-trans Kevin Wolf
2022-08-02 13:37 ` [PULL 6/7] qemu-iotests: Discard stderr when probing devices Kevin Wolf
2022-08-02 13:37 ` [PULL 7/7] main loop: add missing documentation links to GS/IO macros Kevin Wolf
2022-08-02 15:34 ` [PULL 0/7] Block layer patches Richard Henderson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220802133757.138016-4-kwolf@redhat.com \
    --to=kwolf@redhat.com \
    --cc=qemu-block@nongnu.org \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.