linux-kernel - re: [media] Altera FPGA firmware download module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20120614183113.GB6383@elgon.mountain>
Date:	Thu, 14 Jun 2012 21:31:13 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	liplianin@...by
Cc:	linux-kernel@...r.kernel.org
Subject: re: [media] Altera FPGA firmware download module

Hello Igor M. Liplianin,

The patch fa766c9be58b: "[media] Altera FPGA firmware download 
module" from Jan 25, 2011, leads to the following warning:
drivers/misc/altera-stapl/altera.c:2204 altera_get_note()
	 error: strlcpy() 'key' too small (33 vs 256)

drivers/misc/altera-stapl/altera.c
  2200                  if ((i >= 0) && (i < note_count)) {
  2201                          status = 0;
  2202  
  2203                          if (key != NULL)
  2204                                  strlcpy(key, &p[note_strings +
  2205                                                  get_unaligned_be32(
  2206                                                  &p[note_table + (8 * i)])],
  2207                                          length);
  2208  
  2209                          if (value != NULL)
  2210                                  strlcpy(value, &p[note_strings +
  2211                                                  get_unaligned_be32(
  2212                                                  &p[note_table + (8 * i) + 4])],
  2213                                          length);
  2214  
  2215                          *offset = i + 1;

The problem is that strlcpy() is using 256 as the size of "key" but
actually it is the size of "value".  Except that "value" is 257 bytes so
it is an off by one of the size of "value".

It probably doesn't cause a problem, but it upsets the static checkers
and it's pretty ugly.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/