From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Monjalon Subject: Re: [PATCH 2/2] examples/vhost_scsi: fix potential buffer overrun with safe copy API Date: Tue, 22 May 2018 20:18:03 +0200 Message-ID: <9373529.Cr5sn6mvdD@xps> References: <1526599932-13083-1-git-send-email-changpeng.liu@intel.com> <3339436.bIZ7ygsVkQ@xps> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7Bit Cc: "dev@dpdk.org" To: "Liu, Changpeng" Return-path: Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) by dpdk.org (Postfix) with ESMTP id 8FE4D231E for ; Tue, 22 May 2018 21:42:45 +0200 (CEST) In-Reply-To: List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" 22/05/2018 19:58, Liu, Changpeng: > From: Thomas Monjalon [mailto:thomas@monjalon.net] > > 18/05/2018 01:32, Changpeng Liu: > > > - strlcpy((char *)vpage->params, bdev->name, > > > - sizeof(vpage->params)); > > > + vhost_strcpy_pad((char *)vpage->params, bdev->name, > > > + sizeof(vpage->params), ' '); > > > > Why do you think vhost_strcpy_pad is safer than strlcpy? > > A code Coverity issue 279452 reported for strlcpy, so here replace with internal API can avoid it. I think it is a false positive. Remember that Coverity is just a tool.