From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 99045] The string passed to sscanf() contains an uninitialized value. Date: Sat, 10 Dec 2016 11:57:07 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1484530830==" Return-path: Received: from culpepper.freedesktop.org (culpepper.freedesktop.org [IPv6:2610:10:20:722:a800:ff:fe98:4b55]) by gabe.freedesktop.org (Postfix) with ESMTP id B56766E11D for ; Sat, 10 Dec 2016 11:57:07 +0000 (UTC) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1484530830== Content-Type: multipart/alternative; boundary="14813710270.978c9.18339"; charset="UTF-8" --14813710270.978c9.18339 Date: Sat, 10 Dec 2016 11:57:07 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated https://bugs.freedesktop.org/show_bug.cgi?id=3D99045 Bug ID: 99045 Summary: The string passed to sscanf() contains an uninitialized value. Product: DRI Version: unspecified Hardware: Other OS: Linux (All) Status: NEW Severity: normal Priority: medium Component: libdrm Assignee: dri-devel@lists.freedesktop.org Reporter: archer_ame@yahoo.co.jp Created attachment 128403 --> https://bugs.freedesktop.org/attachment.cgi?id=3D128403&action=3Dedit Patch to fix null termination. The function drmParsePciBusInfo() in xf86drm.c reads the contents of the fi= le "/sys/dev/char/x:y/device/uevent" into the buffer. The string written to the buffer by read() is not null-terminated, but this function is writing null only at the end of the buffer. As a result, the string passed to sscanf() contains an uninitialized value = and sscanf uses it. For example, The string that should be passed to sscanf(). "The contents of the file\0" The string actually passed to sscanf(). "The contents of the file and uninitialized value until the end of the buffer\0" --=20 You are receiving this mail because: You are the assignee for the bug.= --14813710270.978c9.18339 Date: Sat, 10 Dec 2016 11:57:07 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated
Bug ID 99045
Summary The string passed to sscanf() contains an uninitialized value.
Product DRI
Version unspecified
Hardware Other
OS Linux (All)
Status NEW
Severity normal
Priority medium
Component libdrm
Assignee dri-devel@lists.freedesktop.org
Reporter archer_ame@yahoo.co.jp 

Created attachmen=
t 128403 [details] [review]
Patch to fix null termination.

The function drmParsePciBusInfo() in xf86drm.c reads the contents of the fi=
le
"/sys/dev/char/x:y/device/uevent" into the buffer.
The string written to the buffer by read() is not null-terminated, but this
function is writing null only at the end of the buffer.
As a result, the string passed to sscanf() contains an uninitialized value =
and
sscanf uses it.

For example,
The string that should be passed to sscanf().
"The contents of the file\0"

The string actually passed to sscanf().
"The contents of the file and uninitialized value until the end of the
buffer\0"

You are receiving this mail because:
  • You are the assignee for the bug.
= --14813710270.978c9.18339-- --===============1484530830== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== --===============1484530830==--