Skip to contentSkip to conversation

bna: Avoid reading past end of buffer

PATCH Applied Kees Cook 2 participants 2 messages May 5, 2017 – May 8, 2017

Subsystems (3)
Networking Network drivers Brocade bna 10 gigabit Ethernet driver
lore
Share & tools
lore

Kees Cook

author
#0 lore raw

PATCH 1/1 bna: Avoid reading past end of buffer

Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros.

This was found with the future CONFIG_FORTIFY_SOURCE feature.

Cc Daniel Micay <[email protected]>
Signed-off-by Kees Cook <[email protected]>
---
 drivers/net/ethernet/brocade/bna/bfa_ioc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/brocade/bna/bfa_ioc.c +1 -1
index 0f6811860ad5..a36e38676640 100644
@@ -2845,7 +2845,7 @@ bfa_ioc_get_adapter_optrom_ver(struct bfa_ioc *ioc, char *optrom_ver)
 static void
 bfa_ioc_get_adapter_manufacturer(struct bfa_ioc *ioc, char *manufacturer)
 {
-	memcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
+	strncpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
 }
 
 static void
Signature · 6 lines
2.7.4


-- 
Kees Cook
Pixel Security
maintainer Applied
#1 lore raw

From: Kees Cook <[email protected]>
Date: Fri, 5 May 2017 15:25:32 -0700

Quoted 9 lines

Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros.

This was found with the future CONFIG_FORTIFY_SOURCE feature.

Cc Daniel Micay <[email protected]>
Signed-off-by Kees Cook <[email protected]>

Applied.