drm: Branch 'master'

 xf86drm.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 3627f38da9fad7db7fef2a0c6d0faf706c2e21d6
Author: Damien Lespiau <[email protected]>
Date:   Fri Jan 22 12:41:55 2016 +0000

    xf86drm: Bound strstr() to the allocated data
    
    We are reading at most sizeof(data) bytes, but then data may not contain
    a terminating '\0', at least in theory, so strstr() may overflow the
    stack allocated array.
    
    Make sure that data always contains at least one '\0'.
    
    Signed-off-by: Damien Lespiau <[email protected]>
    Reviewed-by: Ville Syrjälä <[email protected]>

diff --git a/xf86drm.c b/xf86drm.c
index 7e28b4f..5f587d9 100644
--- a/xf86drm.c
+++ b/xf86drm.c
@@ -2863,7 +2863,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info)
 {
 #ifdef __linux__
     char path[PATH_MAX + 1];
-    char data[128];
+    char data[128 + 1];
     char *str;
     int domain, bus, dev, func;
     int fd, ret;
@@ -2874,6 +2874,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info)
         return -errno;
 
     ret = read(fd, data, sizeof(data));
+    data[128] = '\0';
     close(fd);
     if (ret < 0)
         return -errno;

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140

--
_______________________________________________
Dri-patches mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/dri-patches