mirror of
https://github.com/opnsense/src.git
synced 2026-02-13 15:57:05 -05:00
The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".
This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.
PR: 215474
Reported by: Coverity
CID: 1009997 1010000
|
||
|---|---|---|
| .. | ||
| balloon | ||
| block | ||
| console | ||
| mmio | ||
| network | ||
| pci | ||
| random | ||
| scsi | ||
| virtio.c | ||
| virtio.h | ||
| virtio_bus_if.m | ||
| virtio_config.h | ||
| virtio_ids.h | ||
| virtio_if.m | ||
| virtio_ring.h | ||
| virtqueue.c | ||
| virtqueue.h | ||