[Bug 99045] The string passed to sscanf() contains an uninitialized value.

* [Bug 99045] The string passed to sscanf() contains an uninitialized value.
@ 2016-12-10 11:57 bugzilla-daemon
  2016-12-12 13:54 ` bugzilla-daemon
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: bugzilla-daemon @ 2016-12-10 11:57 UTC (permalink / raw)
  To: dri-devel

[-- Attachment #1.1: Type: text/plain, Size: 1305 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=99045

            Bug ID: 99045
           Summary: The string passed to sscanf() contains an
                    uninitialized value.
           Product: DRI
           Version: unspecified
          Hardware: Other
                OS: Linux (All)
            Status: NEW
          Severity: normal
          Priority: medium
         Component: libdrm
          Assignee: dri-devel@lists.freedesktop.org
          Reporter: archer_ame@yahoo.co.jp

Created attachment 128403
  --> https://bugs.freedesktop.org/attachment.cgi?id=128403&action=edit
Patch to fix null termination.

The function drmParsePciBusInfo() in xf86drm.c reads the contents of the file
"/sys/dev/char/x:y/device/uevent" into the buffer.
The string written to the buffer by read() is not null-terminated, but this
function is writing null only at the end of the buffer.
As a result, the string passed to sscanf() contains an uninitialized value and
sscanf uses it.

For example,
The string that should be passed to sscanf().
"The contents of the file\0"

The string actually passed to sscanf().
"The contents of the file and uninitialized value until the end of the
buffer\0"

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2861 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 4+ messages in thread