[igt-dev] [PATCH i-g-t] tests/testdisplay: fix heap overflow

[igt-dev] [PATCH i-g-t] tests/testdisplay: fix heap overflow

[Ser, Simon]

We need to copy the terminating NULL byte too.

Signed-off-by: Simon Ser <simon.ser@intel.com>
---
 tests/testdisplay.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/testdisplay.c b/tests/testdisplay.c
index b3657264..ff208384 100644
--- a/tests/testdisplay.c
+++ b/tests/testdisplay.c
@@ -563,17 +563,17 @@ static gboolean input_event(GIOChannel *source,
GIOCondition condition,
 	return TRUE;
 }
 
-static void enter_exec_path( char **argv )
+static void enter_exec_path(char **argv)
 {
 	char *exec_path = NULL;
 	char *pos = NULL;
 	short len_path = 0;
 	int ret;
 
-	len_path = strlen( argv[0] );
-	exec_path = (char*) malloc(len_path);
+	len_path = strlen(argv[0]);
+	exec_path = (char*) malloc(len_path + 1);
 
-	memcpy(exec_path, argv[0], len_path);
+	memcpy(exec_path, argv[0], len_path + 1);
 	pos = strrchr(exec_path, '/');
 	if (pos != NULL)
 		*(pos+1) = '\0';
-- 
2.21.0

---------------------------------------------------------------------
Intel Finland Oy
Registered Address: PL 281, 00181 Helsinki 
Business Identity Code: 0357606 - 4 
Domiciled in Helsinki 

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.
_______________________________________________
igt-dev mailing list
igt-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/igt-dev

Re: [igt-dev] [PATCH i-g-t] tests/testdisplay: fix heap overflow

[Jani Nikula]

On Wed, 20 Mar 2019, "Ser, Simon" <simon.ser@intel.com> wrote:
> We need to copy the terminating NULL byte too.
>
> Signed-off-by: Simon Ser <simon.ser@intel.com>
> ---
>  tests/testdisplay.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/tests/testdisplay.c b/tests/testdisplay.c
> index b3657264..ff208384 100644
> --- a/tests/testdisplay.c
> +++ b/tests/testdisplay.c
> @@ -563,17 +563,17 @@ static gboolean input_event(GIOChannel *source,
> GIOCondition condition,
>  	return TRUE;
>  }
>  
> -static void enter_exec_path( char **argv )
> +static void enter_exec_path(char **argv)
>  {
>  	char *exec_path = NULL;
>  	char *pos = NULL;
>  	short len_path = 0;
>  	int ret;
>  
> -	len_path = strlen( argv[0] );
> -	exec_path = (char*) malloc(len_path);
> +	len_path = strlen(argv[0]);
> +	exec_path = (char*) malloc(len_path + 1);
>  
> -	memcpy(exec_path, argv[0], len_path);
> +	memcpy(exec_path, argv[0], len_path + 1);

Ditch all of the above and replace with

	exec_path = strdup(argv[0]);

BR,
Jani.


>  	pos = strrchr(exec_path, '/');
>  	if (pos != NULL)
>  		*(pos+1) = '\0';

-- 
Jani Nikula, Intel Open Source Graphics Center
_______________________________________________
igt-dev mailing list
igt-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/igt-dev

Re: [igt-dev] [PATCH i-g-t] tests/testdisplay: fix heap overflow

[Chris Wilson]

Quoting Jani Nikula (2019-03-20 09:26:32)
> On Wed, 20 Mar 2019, "Ser, Simon" <simon.ser@intel.com> wrote:
> > We need to copy the terminating NULL byte too.
> >
> > Signed-off-by: Simon Ser <simon.ser@intel.com>
> > ---
> >  tests/testdisplay.c | 8 ++++----
> >  1 file changed, 4 insertions(+), 4 deletions(-)
> >
> > diff --git a/tests/testdisplay.c b/tests/testdisplay.c
> > index b3657264..ff208384 100644
> > --- a/tests/testdisplay.c
> > +++ b/tests/testdisplay.c
> > @@ -563,17 +563,17 @@ static gboolean input_event(GIOChannel *source,
> > GIOCondition condition,
> >       return TRUE;
> >  }
> >  
> > -static void enter_exec_path( char **argv )
> > +static void enter_exec_path(char **argv)
> >  {
> >       char *exec_path = NULL;
> >       char *pos = NULL;
> >       short len_path = 0;
> >       int ret;
> >  
> > -     len_path = strlen( argv[0] );
> > -     exec_path = (char*) malloc(len_path);
> > +     len_path = strlen(argv[0]);
> > +     exec_path = (char*) malloc(len_path + 1);
> >  
> > -     memcpy(exec_path, argv[0], len_path);
> > +     memcpy(exec_path, argv[0], len_path + 1);
> 
> Ditch all of the above and replace with
> 
>         exec_path = strdup(argv[0]);
> 
> >       pos = strrchr(exec_path, '/');
> >       if (pos != NULL)
> >               *(pos+1) = '\0';

And even one step further with dirname(3).
-Chris
_______________________________________________
igt-dev mailing list
igt-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/igt-dev