drm/modes: Fix unterminated strncpy
authorChuhong Yuan <hslester96@gmail.com>
Wed, 31 Jul 2019 02:01:40 +0000 (10:01 +0800)
committerMaxime Ripard <maxime.ripard@bootlin.com>
Sat, 3 Aug 2019 10:03:01 +0000 (12:03 +0200)
strncpy(dest, src, strlen(src)) leads to unterminated
dest, which is dangerous.
Fix it by using strscpy.

Fixes: 3aeeb13d8996 ("drm/modes: Support modes names on the command line")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190731020140.3529-1-hslester96@gmail.com
drivers/gpu/drm/drm_modes.c

index 80fcd5d..b0369e6 100644 (file)
@@ -1770,7 +1770,9 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
        }
 
        if (named_mode) {
-               strncpy(mode->name, name, mode_end);
+               if (mode_end + 1 > DRM_DISPLAY_MODE_LEN)
+                       return false;
+               strscpy(mode->name, name, mode_end + 1);
        } else {
                ret = drm_mode_parse_cmdline_res_mode(name, mode_end,
                                                      parse_extras,