From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1qKPTp-0000Pa-Uq for mharc-grub-devel@gnu.org; Fri, 14 Jul 2023 16:33:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qKPTo-0000PC-1C for grub-devel@gnu.org; Fri, 14 Jul 2023 16:33:32 -0400 Received: from mail-qv1-xf2c.google.com ([2607:f8b0:4864:20::f2c]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qKPTm-0000vJ-Lk for grub-devel@gnu.org; Fri, 14 Jul 2023 16:33:31 -0400 Received: by mail-qv1-xf2c.google.com with SMTP id 6a1803df08f44-63770af327fso13814416d6.2 for ; Fri, 14 Jul 2023 13:33:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficientek-com.20221208.gappssmtp.com; s=20221208; t=1689366809; x=1691958809; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=iypwNepaHRA212FQL+btRYcYERC2zEn7HNFiLPsDtks=; b=ey+/xo0RlNrLtbGDN4VxrxlyUMe01L5e+7ZtKmd4+FXNPAUFlB/KVMGVu9Op9tH6JA gBTuOGU1ylsXUPZm5EuQz/KLZ01LT6KwVp++BEIjLSEjh+XzcdUtfbSu1wmrnJJ5mczq R2yivHIx2wwA2looarN6+h6gCncB+7RRiaaJKdNiu6G2I68UeXC7puYvtU+YEXYNxzod hSm6il5iTMvGxwXp4AdmjBlaUvd5YIVFtXpvhRWLW//y9NxC126z/8b2DpNW3fRJdT1w anYxCNWgLOGwKkJ6/omOuKimyNBKt83JV+ARJaG8feBLLmU6Dv/HIoq4+ZK6Je4w323p KjIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689366809; x=1691958809; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=iypwNepaHRA212FQL+btRYcYERC2zEn7HNFiLPsDtks=; b=bfIM1nbuYR73bpkElXpvXSlXlkrJm6WiZDnVBtkozDHTfgZqI/1dP2MEuMR1pmCh/c l8+pw7cCqRJaeaUFwN/t2GSzqGY+oMIL09d0A12I8SN9msJDBo6l9BXP3cU0Q+y04qsk m4nhUvkMeYpgyyOQlqOaaLUBgB0PIvxH5/9TCTccwgNjf77nLCR1qnZAiebn/plfm0iM YFw721pj8ySu7vTfgXkgeTgR3BmH6cfyvxlgIYr5SBUiTpEUOa8dIrkCR4lnBqTP1Cm0 IT70gCvCcq1plwrA4BeLRUu1u0zYEfU3QkOcVxK7q6DlFRk8w7dupaw2L2VhqH0yuQUJ i+3Q== X-Gm-Message-State: ABy/qLaQJTNoJyR6Gr+/FQtLWHViwVCqNh03Meo6dKPdElbE3jWyTRxs fCAF9MxjMdTF/QWyN4d1cuioOlT9CNEc3lWuoiPyUg== X-Google-Smtp-Source: APBJJlG6HB173W4Xoh8ldCvu02jZbUKZnqnjzZahVU6TMX4YDEx+G6WPdF9EMWsdBLGoMsxPyW4T7w== X-Received: by 2002:a0c:a889:0:b0:630:21a6:bb5e with SMTP id x9-20020a0ca889000000b0063021a6bb5emr4630349qva.30.1689366809080; Fri, 14 Jul 2023 13:33:29 -0700 (PDT) Received: from localhost.localdomain ([199.58.83.12]) by smtp.gmail.com with ESMTPSA id u14-20020a0c8dce000000b00632191a70a2sm4219166qvb.103.2023.07.14.13.33.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Jul 2023 13:33:28 -0700 (PDT) From: Glenn Washburn To: grub-devel@gnu.org, Daniel Kiper Cc: Glenn Washburn Subject: [PATCH] term/serial: Ensure proper NULL termination after grub_strncpy Date: Fri, 14 Jul 2023 15:33:19 -0500 Message-Id: <20230714203319.1778630-1-development@efficientek.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::f2c; envelope-from=development@efficientek.com; helo=mail-qv1-xf2c.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Jul 2023 20:33:32 -0000 A large enough argument to the --port option could cause a string buffer to be not NULL terminated because grub_strncpy() does not guarantee NULL termination if copied string is longer than max characters to copy. Fixes: 712309eaae04 (term/serial: Use grub_strncpy() instead of grub_snprintf() when only copying string) Signed-off-by: Glenn Washburn --- grub-core/term/serial.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/grub-core/term/serial.c b/grub-core/term/serial.c index 869555430153..8260dcb7a87a 100644 --- a/grub-core/term/serial.c +++ b/grub-core/term/serial.c @@ -257,7 +257,10 @@ grub_cmd_serial (grub_extcmd_context_t ctxt, int argc, char **args) { if (grub_strncmp (state[OPTION_PORT].arg, "mmio,", sizeof ("mmio,") - 1) == 0 || grub_strncmp (state[OPTION_PORT].arg, "pci,", sizeof ("pci,") - 1) == 0) - grub_strncpy (pname, state[1].arg, sizeof (pname)); + { + grub_strncpy (pname, state[1].arg, sizeof (pname)); + pname[sizeof (pname) - 1] = '\0'; + } else grub_snprintf (pname, sizeof (pname), "port%lx", grub_strtoul (state[1].arg, 0, 0)); -- 2.34.1