[Mesa-dev] [PATCH] gallium/aux/hud: Avoid possible buffer overflow

[Gert Wollny]

Limit the length of acceptable cpu names for use in hud_get_num_cpufreq
in order to avoid a buffer overflow later in add_object when this name 
is copied into cpufreq_info::name.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105274
Signed-off-by: Gert Wollny <gw.fossdev at gmail.com>
---
Submitter has no git write access. 
 src/gallium/auxiliary/hud/hud_cpufreq.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/gallium/auxiliary/hud/hud_cpufreq.c b/src/gallium/auxiliary/hud/hud_cpufreq.c
index 78a660795c..04f69231eb 100644
--- a/src/gallium/auxiliary/hud/hud_cpufreq.c
+++ b/src/gallium/auxiliary/hud/hud_cpufreq.c
@@ -207,8 +207,12 @@ hud_get_num_cpufreq(bool displayhelp)
 
    while ((dp = readdir(dir)) != NULL) {
 
-      /* Avoid 'lo' and '..' and '.' */
-      if (strlen(dp->d_name) <= 2)
+      size_t d_name_len = strlen(dp->d_name);
+
+      /* Avoid 'lo' and '..' and '.', and avoid overlong names that
+       * would  result in a buffer overflow in add_object.
+       */
+      if (d_name_len <= 2 || d_name_len > 15)
          continue;
 
       if (sscanf(dp->d_name, "cpu%d\n", &cpu_index) != 1)
-- 
2.16.1