Bug 99045 - The string passed to sscanf() contains an uninitialized value.
Summary: The string passed to sscanf() contains an uninitialized value.
Status: RESOLVED FIXED
Alias: None
Product: DRI
Classification: Unclassified
Component: libdrm (show other bugs)
Version: unspecified
Hardware: Other Linux (All)
: medium normal
Assignee: Default DRI bug account
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-10 11:57 UTC by taro yamada
Modified: 2017-01-16 14:45 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
Patch to fix null termination. (452 bytes, patch)
2016-12-10 11:57 UTC, taro yamada
no flags Details | Splinter Review

Description taro yamada 2016-12-10 11:57:07 UTC
Created attachment 128403 [details] [review]
Patch to fix null termination.

The function drmParsePciBusInfo() in xf86drm.c reads the contents of the file "/sys/dev/char/x:y/device/uevent" into the buffer.
The string written to the buffer by read() is not null-terminated, but this function is writing null only at the end of the buffer.
As a result, the string passed to sscanf() contains an uninitialized value and sscanf uses it.

For example,
The string that should be passed to sscanf().
"The contents of the file\0"

The string actually passed to sscanf().
"The contents of the file and uninitialized value until the end of the buffer\0"
Comment 1 Emil Velikov 2016-12-12 13:54:15 UTC
Hi Taro Yamada, please git send-email patches to dri-devel@lists.freedesktop.org. If you can set the prefix that'll be even better ;-)

$ git config --local format.subjectPrefix "PATCH libdrm"
Comment 2 taro yamada 2016-12-13 08:59:45 UTC
Thanks for reply.
I've tried.
Comment 3 Emil Velikov 2017-01-16 14:45:14 UTC
Just pushed the patch to master. Thanks !


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.