From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756054Ab2LNDtT (ORCPT ); Thu, 13 Dec 2012 22:49:19 -0500 Received: from intranet.asianux.com ([58.214.24.6]:39601 "EHLO intranet.asianux.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755649Ab2LNDtS (ORCPT ); Thu, 13 Dec 2012 22:49:18 -0500 X-Spam-Score: -100.7 Message-ID: <50CAA1F2.9000003@asianux.com> Date: Fri, 14 Dec 2012 11:50:10 +0800 From: Chen Gang User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20120911 Thunderbird/15.0.1 MIME-Version: 1.0 To: Omar Ramirez Luna CC: "linux-kernel@vger.kernel.org" Subject: [Suggestion] drivers/staging/tidspbridge: strcpy and strncpy, src length checking issue. Content-Type: text/plain; charset=GB2312 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello Omar Ramirez Luna: in drivers/staging/tidspbridge/rmgr/proc.c: if strlen(drv_datap->base_img) == size, will pass checking (line 397) the size is the full length of exec_file (line 382, line 468..469) strcpy causes issue: src len is strlen(drv_datap->base_img) + '\0'. (line 400) strncpy seems also has issue: need use size instead of strlen(iva_img) + 1. (line 402..403) please help to check, thanks. gchen. 380 static int get_exec_file(struct cfg_devnode *dev_node_obj, 381 struct dev_object *hdev_obj, 382 u32 size, char *exec_file) 383 { 384 u8 dev_type; 385 s32 len; 386 struct drv_data *drv_datap = dev_get_drvdata(bridge); 387 388 dev_get_dev_type(hdev_obj, (u8 *) &dev_type); 389 390 if (!exec_file) 391 return -EFAULT; 392 393 if (dev_type == DSP_UNIT) { 394 if (!drv_datap || !drv_datap->base_img) 395 return -EFAULT; 396 397 if (strlen(drv_datap->base_img) > size) 398 return -EINVAL; 399 400 strcpy(exec_file, drv_datap->base_img); 401 } else if (dev_type == IVA_UNIT && iva_img) { 402 len = strlen(iva_img); 403 strncpy(exec_file, iva_img, len + 1); 404 } else { 405 return -ENOENT; 406 } 407 408 return 0; 409 } 410 ... 465 /* Get the default executable for this board... */ 466 dev_get_dev_type(hdev_obj, (u8 *) &dev_type); 467 p_proc_object->processor_id = dev_type; 468 status = get_exec_file(dev_node_obj, hdev_obj, sizeof(sz_exec_file), 469 sz_exec_file);