Proxmox-Port/swtpm
1
0
Fork 0
mirror of https://github.com/stefanberger/swtpm.git synced 2026-02-03 19:58:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use memcpy rather than strncpy and leave note in code

Browse Source 
Coverity found that the usage of strncpy may leave an unterminated
string. In this case it is ok, if the string is unterminated since
it would only be the part of a response and the client would have
to collect all the parts as indicated by the total length of the
string. So we use memcpy instead and leave a note in the code. So
far the strings would not nearly be 3k to get close to the maximum.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
This commit is contained in:
Stefan Berger 2018-05-14 16:46:07 -04:00
parent 2fe082cde6
commit 5b63c5dbff
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/swtpm/ctrlchannel.c
View File

@ -822,7 +822,8 @@ int ctrlchannel_process_fd(int fd,
pgi->u.resp.tpm_result = htobe32(0);
pgi->u.resp.totlength = htobe32(strlen(info_data) + 1);
pgi->u.resp.length = htobe32(length);
strncpy(pgi->u.resp.buffer, &info_data[offset], length);
/* client has to collect whole string in case buffer is too small */
memcpy(pgi->u.resp.buffer, &info_data[offset], length);
free(info_data);
out_len = offsetof(ptm_getinfo, u.resp.buffer) + length;

3
src/swtpm/cuse_tpm.c
View File

@ -1226,7 +1226,8 @@ static void ptm_ioctl(fuse_req_t req, int cmd, void *arg,
out_pgi.u.resp.tpm_result = 0;
out_pgi.u.resp.totlength = strlen(info_data) + 1;
out_pgi.u.resp.length = length;
strncpy(out_pgi.u.resp.buffer, &info_data[offset], length);
/* client has to collect whole string in case buffer is too small */
memcpy(out_pgi.u.resp.buffer, &info_data[offset], length);
free(info_data);
fuse_reply_ioctl(req, 0, &out_pgi, sizeof(out_pgi));