From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sean Paul Subject: Re: [PATCH] drm/modes: Fix unterminated strncpy Date: Tue, 30 Jul 2019 13:12:27 -0400 Message-ID: <20190730171227.GS104440@art_vandelay> References: <20190730084032.26428-1-hslester96@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20190730084032.26428-1-hslester96@gmail.com> Sender: linux-kernel-owner@vger.kernel.org To: Chuhong Yuan Cc: Maarten Lankhorst , Maxime Ripard , Sean Paul , David Airlie , Daniel Vetter , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org List-Id: dri-devel@lists.freedesktop.org On Tue, Jul 30, 2019 at 04:40:32PM +0800, Chuhong Yuan wrote: > strncpy(dest, src, strlen(src)) leads to unterminated > dest, which is dangerous. > Fix it by using strscpy. > > Signed-off-by: Chuhong Yuan > --- > drivers/gpu/drm/drm_modes.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c > index 80fcd5dc1558..170fc24e0f31 100644 > --- a/drivers/gpu/drm/drm_modes.c > +++ b/drivers/gpu/drm/drm_modes.c > @@ -1770,7 +1770,7 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option, > } > > if (named_mode) { > - strncpy(mode->name, name, mode_end); > + strscpy(mode->name, name, mode_end + 1); Shouldn't you be checking that mode_end + 1 is not > than the size of mode->name (ie: DRM_DISPLAY_MODE_LEN)? This still seems unsafe. Sean > } else { > ret = drm_mode_parse_cmdline_res_mode(name, mode_end, > parse_extras, > -- > 2.20.1 > -- Sean Paul, Software Engineer, Google / Chromium OS