From b1f931b0c3be12d52d9b15627eb1b2fb2efdd467 Mon Sep 17 00:00:00 2001 From: Robert Foss Date: Fri, 6 Jan 2017 09:28:50 +0000 Subject: lib/igt_debugfs: Prevent buffer overflow buf array may overflow with when writing '\0' if MAX_LINE_LEN bytes are read during read(). Signed-off-by: Robert Foss Reviewed-by: Petri Latvala --- lib/igt_debugfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'lib/igt_debugfs.c') diff --git a/lib/igt_debugfs.c b/lib/igt_debugfs.c index d828687a..982573d7 100644 --- a/lib/igt_debugfs.c +++ b/lib/igt_debugfs.c @@ -597,10 +597,12 @@ static int read_crc(igt_pipe_crc_t *pipe_crc, igt_crc_t *out) bytes_read = read(pipe_crc->crc_fd, &buf, read_len); igt_reset_timeout(); - if (bytes_read < 0 && errno == EAGAIN) { + if (bytes_read < 0 && errno == EAGAIN) igt_assert(pipe_crc->flags & O_NONBLOCK); + + if (bytes_read < 0) bytes_read = 0; - } + buf[bytes_read] = '\0'; if (bytes_read && !pipe_crc_init_from_string(pipe_crc, out, buf)) -- cgit v1.2.3