Commit f3a330b3 authored by Daniel Micay's avatar Daniel Micay Committed by Kleber Sacilotto de Souza

staging/rts5208: Fix read overflow in memcpy

BugLink: https://bugs.launchpad.net/bugs/1798539

commit 88a5b39b upstream.

Noticed by FORTIFY_SOURCE, this swaps memcpy() for strncpy() to zero-value
fill the end of the buffer instead of over-reading a string from .rodata.
Signed-off-by: default avatarDaniel Micay <danielmicay@gmail.com>
[kees: wrote commit log]
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Wayne Porter <wporter82@gmail.com>
Signed-off-by: default avatarAmit Pundir <amit.pundir@linaro.org>
Signed-off-by: default avatarStefan Bader <stefan.bader@canonical.com>
Signed-off-by: default avatarKleber Sacilotto de Souza <kleber.souza@canonical.com>
parent aa11acab
...@@ -536,7 +536,7 @@ static int inquiry(struct scsi_cmnd *srb, struct rtsx_chip *chip) ...@@ -536,7 +536,7 @@ static int inquiry(struct scsi_cmnd *srb, struct rtsx_chip *chip)
if (sendbytes > 8) { if (sendbytes > 8) {
memcpy(buf, inquiry_buf, 8); memcpy(buf, inquiry_buf, 8);
memcpy(buf + 8, inquiry_string, sendbytes - 8); strncpy(buf + 8, inquiry_string, sendbytes - 8);
if (pro_formatter_flag) { if (pro_formatter_flag) {
/* Additional Length */ /* Additional Length */
buf[4] = 0x33; buf[4] = 0x33;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment