From: Auke Kok Date: Wed, 27 Sep 2006 19:53:17 +0000 (-0700) Subject: e100, e1000, ixgb: Fix an impossible memory overwrite bug X-Git-Tag: v2.6.19-rc1~372^2~5^2~23 X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=0eb5a34cdf34ad07b6db2df1e523aaf6574601b4;p=karo-tx-linux.git e100, e1000, ixgb: Fix an impossible memory overwrite bug We keep getting requests from people that think that this might be an exploitable hole where we would overwrite 4 bytes in the netdev struct if the pci name would exceed 15 characters. In reality this will never happen but we fix it anyway. Signed-off-by: Auke Kok --- diff --git a/drivers/net/e100.c b/drivers/net/e100.c index d9750e269a56..ab0868cb120c 100644 --- a/drivers/net/e100.c +++ b/drivers/net/e100.c @@ -2572,7 +2572,7 @@ static int __devinit e100_probe(struct pci_dev *pdev, #ifdef CONFIG_NET_POLL_CONTROLLER netdev->poll_controller = e100_netpoll; #endif - strcpy(netdev->name, pci_name(pdev)); + strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1); nic = netdev_priv(netdev); nic->netdev = netdev; diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c index 082c02918a41..bd673802e8ce 100644 --- a/drivers/net/e1000/e1000_main.c +++ b/drivers/net/e1000/e1000_main.c @@ -759,7 +759,7 @@ e1000_probe(struct pci_dev *pdev, #ifdef CONFIG_NET_POLL_CONTROLLER netdev->poll_controller = e1000_netpoll; #endif - strcpy(netdev->name, pci_name(pdev)); + strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1); netdev->mem_start = mmio_start; netdev->mem_end = mmio_start + mmio_len; diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c index a88c2b8b66b1..fb4c1ad745b2 100644 --- a/drivers/net/ixgb/ixgb_main.c +++ b/drivers/net/ixgb/ixgb_main.c @@ -437,7 +437,7 @@ ixgb_probe(struct pci_dev *pdev, netdev->poll_controller = ixgb_netpoll; #endif - strcpy(netdev->name, pci_name(pdev)); + strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1); netdev->mem_start = mmio_start; netdev->mem_end = mmio_start + mmio_len; netdev->base_addr = adapter->hw.io_base;