[PATCH v2] drm/modes: Fix unterminated strncpy

Chuhong Yuan hslester96 at gmail.com
Wed Jul 31 02:01:40 UTC 2019


strncpy(dest, src, strlen(src)) leads to unterminated
dest, which is dangerous.
Fix it by using strscpy.

Signed-off-by: Chuhong Yuan <hslester96 at gmail.com>
---
Changes in v2:
  - Check whether mode_end + 1 exceeds
	the size of mode->name.

 drivers/gpu/drm/drm_modes.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 80fcd5dc1558..b0369e690f36 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1770,7 +1770,9 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 	}
 
 	if (named_mode) {
-		strncpy(mode->name, name, mode_end);
+		if (mode_end + 1 > DRM_DISPLAY_MODE_LEN)
+			return false;
+		strscpy(mode->name, name, mode_end + 1);
 	} else {
 		ret = drm_mode_parse_cmdline_res_mode(name, mode_end,
 						      parse_extras,
-- 
2.20.1



More information about the dri-devel mailing list