[Xen-devel] [PATCH] linux-2.6.18/drivers/xen/: user strlcpy() instead of strncpy()

["Jan Beulich" <JBeulich@xxxxxxxx>]

... for being the safer alternative.

In blktap2, snprintf() also gets replaced by strlcpy(), and the bounds
check in blktap_sysfs_set_name() also gets adjusted.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>

--- a/drivers/xen/blktap/xenbus.c
+++ b/drivers/xen/blktap/xenbus.c
@@ -72,24 +72,22 @@ static int strsep_len(const char *str, c
                                 return i;
                         len--;
                 }
-        return (len == 0) ? i : -ERANGE;
+        return -ERANGE;
 }
 
 static long get_id(const char *str)
 {
-        int len,end;
+       int len;
         const char *ptr;
-        char *tptr, num[10];
+       char num[10];
        
         len = strsep_len(str, '/', 2);
-        end = strlen(str);
-        if ( (len < 0) || (end < 0) ) return -1;
+       if (len < 0)
+               return -1;
        
         ptr = str + len + 1;
-        strncpy(num,ptr,end - len);
-        tptr = num + (end - (len + 1));
-        *tptr = '\0';
-       DPRINTK("Get_id called for %s (%s)\n",str,num);
+       strlcpy(num, ptr, ARRAY_SIZE(num));
+       DPRINTK("get_id(%s) -> %s\n", str, num);
        
         return simple_strtol(num, NULL, 10);
 }                              
--- a/drivers/xen/blktap2/sysfs.c
+++ b/drivers/xen/blktap2/sysfs.c
@@ -65,12 +65,12 @@ blktap_sysfs_set_name(struct class_devic
                goto out;
        }
 
-       if (strnlen(buf, BLKTAP2_MAX_MESSAGE_LEN) >= BLKTAP2_MAX_MESSAGE_LEN) {
+       if (strnlen(buf, size) >= size) {
                err = -EINVAL;
                goto out;
        }
 
-       snprintf(tap->params.name, sizeof(tap->params.name) - 1, "%s", buf);
+       strlcpy(tap->params.name, buf, size);
        err = size;
 
 out:
--- a/drivers/xen/usbback/usbstub.c
+++ b/drivers/xen/usbback/usbstub.c
@@ -110,7 +110,7 @@ int portid_add(const char *busid,
        portid->handle = handle;
        portid->portnum = portnum;
 
-       strncpy(portid->phys_bus, busid, BUS_ID_SIZE);
+       strlcpy(portid->phys_bus, busid, BUS_ID_SIZE);
 
        spin_lock_irqsave(&port_list_lock, flags);
        list_add(&portid->id_list, &port_list);
--- a/drivers/xen/xenoprof/xenoprofile.c
+++ b/drivers/xen/xenoprof/xenoprofile.c
@@ -553,9 +553,8 @@ int __init xenoprofile_init(struct oprof
                xenoprof_arch_init_counter(&init);
                xenoprof_is_primary = init.is_primary;
 
-               /*  cpu_type is detected by Xen */
-               cpu_type[XENOPROF_CPU_TYPE_SIZE-1] = 0;
-               strncpy(cpu_type, init.cpu_type, XENOPROF_CPU_TYPE_SIZE - 1);
+               /* cpu_type is detected by Xen */
+               strlcpy(cpu_type, init.cpu_type, XENOPROF_CPU_TYPE_SIZE);
                xenoprof_ops.cpu_type = cpu_type;
 
                init_driverfs();

Attachment: xen-strlcpy.patch
Description: Text document

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel