<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - The string passed to sscanf() contains an uninitialized value."
href="https://bugs.freedesktop.org/show_bug.cgi?id=99045">99045</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>The string passed to sscanf() contains an uninitialized value.
</td>
</tr>
<tr>
<th>Product</th>
<td>DRI
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>libdrm
</td>
</tr>
<tr>
<th>Assignee</th>
<td>dri-devel@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>archer_ame@yahoo.co.jp
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=128403" name="attach_128403" title="Patch to fix null termination.">attachment 128403</a> <a href="attachment.cgi?id=128403&action=edit" title="Patch to fix null termination.">[details]</a></span> <a href='page.cgi?id=splinter.html&bug=99045&attachment=128403'>[review]</a>
Patch to fix null termination.
The function drmParsePciBusInfo() in xf86drm.c reads the contents of the file
"/sys/dev/char/x:y/device/uevent" into the buffer.
The string written to the buffer by read() is not null-terminated, but this
function is writing null only at the end of the buffer.
As a result, the string passed to sscanf() contains an uninitialized value and
sscanf uses it.
For example,
The string that should be passed to sscanf().
"The contents of the file\0"
The string actually passed to sscanf().
"The contents of the file and uninitialized value until the end of the
buffer\0"</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>