[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCHv3 12/20] bt: replace fragile snprintf use and unwarr
From: |
Jim Meyering |
Subject: |
[Qemu-devel] [PATCHv3 12/20] bt: replace fragile snprintf use and unwarranted strncpy |
Date: |
Thu, 4 Oct 2012 13:09:55 +0200 |
From: Jim Meyering <address@hidden>
In bt_hci_name_req a failed snprintf could return len larger than
sizeof(params.name), which means the following memset call would
have a "length" value of (size_t)-1, -2, etc... Sounds scary.
But currently, one can deduce that there is no problem:
strlen(slave->lmp_name) is guaranteed to be smaller than
CHANGE_LOCAL_NAME_CP_SIZE, which is the same as sizeof(params.name),
so this cannot happen. Regardless, there is no justification for
using snprintf+memset. Use pstrcpy instead.
Also, in bt_hci_event_complete_read_local_name, use pstrcpy in place
of unwarranted strncpy.
Signed-off-by: Jim Meyering <address@hidden>
---
hw/bt-hci.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/hw/bt-hci.c b/hw/bt-hci.c
index a3a7fb4..47f9a4e 100644
--- a/hw/bt-hci.c
+++ b/hw/bt-hci.c
@@ -943,7 +943,6 @@ static int bt_hci_name_req(struct bt_hci_s *hci, bdaddr_t
*bdaddr)
{
struct bt_device_s *slave;
evt_remote_name_req_complete params;
- int len;
for (slave = hci->device.net->slave; slave; slave = slave->next)
if (slave->page_scan && !bacmp(&slave->bd_addr, bdaddr))
@@ -955,9 +954,7 @@ static int bt_hci_name_req(struct bt_hci_s *hci, bdaddr_t
*bdaddr)
params.status = HCI_SUCCESS;
bacpy(¶ms.bdaddr, &slave->bd_addr);
- len = snprintf(params.name, sizeof(params.name),
- "%s", slave->lmp_name ?: "");
- memset(params.name + len, 0, sizeof(params.name) - len);
+ pstrcpy(params.name, sizeof(params.name), slave->lmp_name ?: "");
bt_hci_event(hci, EVT_REMOTE_NAME_REQ_COMPLETE,
¶ms, EVT_REMOTE_NAME_REQ_COMPLETE_SIZE);
@@ -1388,7 +1385,7 @@ static inline void
bt_hci_event_complete_read_local_name(struct bt_hci_s *hci)
params.status = HCI_SUCCESS;
memset(params.name, 0, sizeof(params.name));
if (hci->device.lmp_name)
- strncpy(params.name, hci->device.lmp_name, sizeof(params.name));
+ pstrcpy(params.name, sizeof(params.name), hci->device.lmp_name);
bt_hci_event_complete(hci, ¶ms, READ_LOCAL_NAME_RP_SIZE);
}
--
1.8.0.rc0.18.gf84667d
- Re: [Qemu-devel] [PATCHv3 01/20] scsi, pci, qdev, isa-bus, sysbus: don't let *_get_fw_dev_path return NULL, (continued)
- [Qemu-devel] [PATCHv3 02/20] sparc: use g_strdup in place of unchecked strdup, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 03/20] block: avoid buffer overrun by using pstrcpy, not strncpy, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 05/20] vmdk: relative_path: use pstrcpy in place of strncpy, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 06/20] hw/9pfs: avoid buffer overrun, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 04/20] sheepdog: avoid a few buffer overruns, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 07/20] lm32: avoid buffer overrun, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 10/20] linux-user: remove two unchecked uses of strdup, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 08/20] os-posix: avoid buffer overrun, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 09/20] ppc: avoid buffer overrun: use pstrcpy, not strncpy, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 12/20] bt: replace fragile snprintf use and unwarranted strncpy,
Jim Meyering <=
- [Qemu-devel] [PATCHv3 11/20] ui/vnc: simplify and avoid strncpy, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 15/20] qemu-ga: prefer pstrcpy: consistently NUL-terminate ifreq.ifr_name, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 16/20] libcacard/vcard_emul_nss: use pstrcpy in place of strncpy, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 13/20] virtio-9p: avoid unwarranted uses of strncpy, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 14/20] vscsi: avoid unwarranted strncpy, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 20/20] doc: update HACKING wrt strncpy/pstrcpy, Jim Meyering, 2012/10/04
- [Qemu-devel] [PATCHv3 18/20] qcow2: mark this file's sole strncpy use as justified, Jim Meyering, 2012/10/04