HomeFreeBSD

MFC r343998:

Description

MFC r343998:

Fix off-by-one error in BERI virtio driver

The hardcoded ident is exactly 20 bytes long but sprintf adds terminating zero,
so there is one byte written out of array bounds.As a fix use strncpy it
appends \0 only if space allows and its behavior matches virtio spec:

When VIRTIO_BLK_T_GET_ID is issued, the device identifier, up to 20 bytes, is
written to the buffer. The identifier should be interpreted as an ascii string.
It is terminated with \0, unless it is exactly 20 bytes long.

PR: 202298
Reviewed by: br
Differential Revision: https://reviews.freebsd.org/D18852

Details

Committed
gonzoMar 23 2019, 11:43 PM
Reviewer
br
Differential Revision
D18852: Fix off-by-one error in BERI virtio driver
Parents
rS345461: Limit the size of messages sent on 1-to-many style SCTP sockets with the
Branches
Unknown
Tags
Unknown