On Wed, 2014-06-04 at 23:36 +0200, Rickard Strandqvist wrote: > Added a guaranteed null-terminate after call to strncpy. > > This was partly found using a static code analysis program called cppcheck. > > Signed-off-by: Rickard Strandqvist <rickard_strandqv...@spectrumdigital.se> > --- > drivers/scsi/mpt2sas/mpt2sas_base.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c > b/drivers/scsi/mpt2sas/mpt2sas_base.c > index bde63f7..4c3eceb 100644 > --- a/drivers/scsi/mpt2sas/mpt2sas_base.c > +++ b/drivers/scsi/mpt2sas/mpt2sas_base.c > @@ -2097,7 +2097,8 @@ _base_display_ioc_capabilities(struct MPT2SAS_ADAPTER > *ioc) > u32 bios_version; > > bios_version = le32_to_cpu(ioc->bios_pg3.BiosVersion); > - strncpy(desc, ioc->manu_pg0.ChipName, 16); > + strncpy(desc, ioc->manu_pg0.ChipName, sizeof(desc)); > + desc[sizeof(desc) - 1] = '\0';
There's no bug here because the specs define the ChipName field of the manufacturing page 0 to be 16 bytes and null terminated. The nasty part is the way this driver is littered with magic numbers. James -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
