drm/nouveau/pm: don't read/write beyond end of stack buffer

PATCH New Jim Meyering 1 participant 1 message Apr 17, 2012

Subsystems (3)

DRM drivers DRM misc nouveau

lore

Share & tools

lore

Jim Meyering

author

2012-04-17 19:30 UTC #0 lore raw

PATCH 1/1 drm/nouveau/pm: don't read/write beyond end of stack buffer

NUL-terminate after strncpy.

If the parameter "profile" has length 16 or more, then strncpy leaves "string" with no NUL terminator, so the following search for '\n' may read beyond the end of that 16-byte buffer. If it finds a newline there, then it will also write beyond the end of that stack buffer.

Signed-off-by Jim Meyering <[email protected]>

---
 drivers/gpu/drm/nouveau/nouveau_pm.c |    1 +
 1 file changed, 1 insertion(+)

drivers/gpu/drm/nouveau/nouveau_pm.c +1 -0

index 34d591b..da3e7c3 100644
@@ -225,26 +225,27 @@ profile_find(struct drm_device *dev, const char *string)
 static int
 nouveau_pm_profile_set(struct drm_device *dev, const char *profile)
 {
 	struct drm_nouveau_private *dev_priv = dev->dev_private;
 	struct nouveau_pm_engine *pm = &dev_priv->engine.pm;
 	struct nouveau_pm_profile *ac = NULL, *dc = NULL;
 	char string[16], *cur = string, *ptr;
 
 	/* safety precaution, for now */
 	if (nouveau_perflvl_wr != 7777)
 		return -EPERM;
 
 	strncpy(string, profile, sizeof(string));
+	string[sizeof(string) - 1] = 0;
 	if ((ptr = strchr(string, '\n')))
 		*ptr = '\0';
 
 	ptr = strsep(&cur, ",");
 	if (ptr)
 		ac = profile_find(dev, ptr);
 
 	ptr = strsep(&cur, ",");
 	if (ptr)
 		dc = profile_find(dev, ptr);
 	else
 		dc = ac;

--
1.7.10.208.gb4267