mirror of
https://github.com/opnsense/src.git
synced 2026-02-15 00:34:33 -05:00
4195c7de24
The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".
This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.
PR: 215474
Reported by: Coverity
CID: 1009997 1010000
|
||
|---|---|---|
| .. | ||
| 00README | ||
| firewire.c | ||
| firewire.h | ||
| firewire_phy.h | ||
| firewirereg.h | ||
| fwcrom.c | ||
| fwdev.c | ||
| fwdma.c | ||
| fwdma.h | ||
| fwmem.c | ||
| fwmem.h | ||
| fwohci.c | ||
| fwohci_pci.c | ||
| fwohcireg.h | ||
| fwohcivar.h | ||
| fwphyreg.h | ||
| iec13213.h | ||
| iec68113.h | ||
| if_fwe.c | ||
| if_fwevar.h | ||
| if_fwip.c | ||
| if_fwipvar.h | ||
| sbp.c | ||
| sbp.h | ||
| sbp_targ.c | ||