From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Green Subject: [PATCH v3 07/40] drivers/net/nfp: fix buffer overflow in fw_name Date: Thu, 10 May 2018 10:46:54 +0800 Message-ID: <152592041441.119328.11000209467072629331.stgit@localhost.localdomain> References: <152591991920.119328.14523975619615362920.stgit@localhost.localdomain> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit To: dev@dpdk.org Return-path: Received: from mail.warmcat.com (mail.warmcat.com [163.172.24.82]) by dpdk.org (Postfix) with ESMTP id 1D04B1B7DE for ; Thu, 10 May 2018 04:46:58 +0200 (CEST) In-Reply-To: <152591991920.119328.14523975619615362920.stgit@localhost.localdomain> List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" /home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c: In function ‘nfp_pf_pci_probe’: /home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c:3160: 23: error: ‘%s’ directive writing up to 99 bytes into a region of size 76 [-Werror=format-overflow=] sprintf(fw_name, "%s/%s.nffw", DEFAULT_FW_PATH, serial); Note fw_buf still has to increase somewhat even after restricting serial[], since otherwise: /home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c: In function ‘nfp_pf_pci_probe’: /home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c:3176:23: error: ‘%s’ directive writing up to 99 bytes into a region of size 76 [-Werror=format-overflow=] sprintf(fw_name, "%s/%s", DEFAULT_FW_PATH, card); ^~ /home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c:3262:32: err = nfp_fw_upload(dev, nsp, card_desc); ~~~~~~~~~ /home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c:3176:2: note: ‘sprintf’ output between 25 and 124 bytes into a destination of size 100 sprintf(fw_name, "%s/%s", DEFAULT_FW_PATH, card); Signed-off-by: Andy Green --- drivers/net/nfp/nfp_net.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/nfp/nfp_net.c b/drivers/net/nfp/nfp_net.c index 199aac40b..f114b1839 100644 --- a/drivers/net/nfp/nfp_net.c +++ b/drivers/net/nfp/nfp_net.c @@ -3144,8 +3144,8 @@ nfp_fw_upload(struct rte_pci_device *dev, struct nfp_nsp *nsp, char *card) struct nfp_cpp *cpp = nsp->cpp; int fw_f; char *fw_buf; - char fw_name[100]; - char serial[100]; + char fw_name[125]; + char serial[40]; struct stat file_stat; off_t fsize, bytes;