diff options
| author | Tobias Stoeckmann <tobias@stoeckmann.org> | 2016-06-25 20:08:31 +0200 |
|---|---|---|
| committer | Xiang, Haihao <haihao.xiang@intel.com> | 2016-08-01 10:58:39 +0800 |
| commit | 1517fd276e12cac14c018d5a30792177eb6c59de (patch) | |
| tree | 0a7cfe2fd2b21bab662df73fa244b33692178e07 /va/va_trace.c | |
| parent | def5691f789b897b47af7f2a7ffa3b135a93950d (diff) | |
| download | libva-1517fd276e12cac14c018d5a30792177eb6c59de.tar.gz | |
Properly terminate parsed environment values with '\0'.
The function strncpy() does not guarantee to nul terminate the
destination. In most cases, this cannot be triggered, but it is also
used to parse user environment variables. These are allowed to be longer
than 1023 characters, effectively resulting in an unterminated string.
I've adjusted other places as well, because it won't hurt.
https://bugs.freedesktop.org/show_bug.cgi?id=96677
Diffstat (limited to 'va/va_trace.c')
| -rw-r--r-- | va/va_trace.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/va/va_trace.c b/va/va_trace.c index 96c076c..13fc6d2 100644 --- a/va/va_trace.c +++ b/va/va_trace.c @@ -546,6 +546,7 @@ static int open_tracing_specil_file( FILE *fp = NULL; strncpy(env_value, fn_env, 1024); + env_value[1023] = '\0'; FILE_NAME_SUFFIX(env_value, 1024, "ctx-", (unsigned int)ptra_ctx->trace_context); @@ -594,6 +595,7 @@ static int open_tracing_log_file( char env_value[1024]; strncpy(env_value, pva_trace->fn_log_env, 1024); + env_value[1023] = '\0'; FILE_NAME_SUFFIX(env_value, 1024, "thd-", (unsigned int)thd_id); |