Martchus
/
mdadm
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

mdadm: fix a buffer overflow 

struct mdp_superblock_1.set_name is 32B long, but struct mdinfo.name
is 33B long. So we need strncpy instead strcpy to avoid buffer
overflow.

Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
This commit is contained in:
Song Liu 2016-09-08 11:21:07 -07:00 committed by Jes Sorensen
parent bd1fd72e13
commit 474267015b
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
super1.c
View File

@ -1294,7 +1294,7 @@ static int update_super1(struct supertype *st, struct mdinfo *info,
strcat(sb->set_name, ":");
strcat(sb->set_name, info->name);
} else
strcpy(sb->set_name, info->name);
strncpy(sb->set_name, info->name, sizeof(sb->set_name));
} else if (strcmp(update, "devicesize") == 0 &&
__le64_to_cpu(sb->super_offset) <
__le64_to_cpu(sb->data_offset)) {
@ -1444,7 +1444,7 @@ static int init_super1(struct supertype *st, mdu_array_info_t *info,
strcat(sb->set_name, ":");
strcat(sb->set_name, name);
} else
strcpy(sb->set_name, name);
strncpy(sb->set_name, name, sizeof(sb->set_name));
sb->ctime = __cpu_to_le64((unsigned long long)time(0));
sb->level = __cpu_to_le32(info->level);