Page MenuHomeFreeBSD

Fix acpidump CID 1011278 (Buffer not null terminated) and other issues
ClosedPublic

Authored by truckman on May 13 2016, 11:22 PM.
Tags
None
Referenced Files
Unknown Object (File)
Feb 22 2024, 7:56 AM
Unknown Object (File)
Dec 19 2023, 11:44 PM
Unknown Object (File)
Oct 27 2023, 9:01 PM
Unknown Object (File)
Jun 26 2023, 10:25 PM
Unknown Object (File)
Jun 26 2023, 10:24 PM
Unknown Object (File)
Jun 26 2023, 10:24 PM
Unknown Object (File)
Jun 26 2023, 10:12 PM
Unknown Object (File)
May 15 2023, 5:55 AM
Subscribers

Details

Summary

Coverity reports that a buffer used for temporary file
generation might not be NUL terminated by strncpy().
This is probably not true because the input gets passed
through realpath(), but if the path name is sufficiently
long the name could be truncated and cause other problems.
The code for generating the temp file names is also overly
complex. Instead of a bunch of calls to strncpy() and and
strncat(), simplify by using snprintf() and add checks for
for unexpected truncation.

Also, the output file created by iasl -d is predictable,
so use mkdtemp() to create a directory to hold the iasl
input and output files.

Check the return values of more syscalls.

Test Plan

Compile and run

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

truckman retitled this revision from to Fix acpidump CID 1011278 (Buffer not null terminated) and other issues.
truckman updated this object.
truckman edited the test plan for this revision. (Show Details)
jkim edited edge metadata.

I haven't looked at it closely but I trust you. :-)

This revision is now accepted and ready to land.May 24 2016, 8:43 PM
This revision was automatically updated to reflect the committed changes.
head/usr.sbin/acpi/acpidump/acpi.c
1486

len-1 -> len - 1 ?

1527–1528

assert? That's kinda nasty and it can be compiled out... errx might make more sense.

head/usr.sbin/acpi/acpidump/acpi.c
1486

The line was getting long and I didn't want to wrap it.

1527–1528

This shouldn't be possible because of the checking on lines 1485-1489. If someone manages to trip this, I want us to get a bug report.