提交 0eb5a34c 编写于 作者: A Auke Kok 提交者: Auke Kok

e100, e1000, ixgb: Fix an impossible memory overwrite bug

We keep getting requests from people that think that this might be
an exploitable hole where we would overwrite 4 bytes in the netdev
struct if the pci name would exceed 15 characters. In reality this
will never happen but we fix it anyway.
Signed-off-by: NAuke Kok <auke-jan.h.kok@intel.com>
上级 0abb6eb1
......@@ -2572,7 +2572,7 @@ static int __devinit e100_probe(struct pci_dev *pdev,
#ifdef CONFIG_NET_POLL_CONTROLLER
netdev->poll_controller = e100_netpoll;
#endif
strcpy(netdev->name, pci_name(pdev));
strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
nic = netdev_priv(netdev);
nic->netdev = netdev;
......
......@@ -759,7 +759,7 @@ e1000_probe(struct pci_dev *pdev,
#ifdef CONFIG_NET_POLL_CONTROLLER
netdev->poll_controller = e1000_netpoll;
#endif
strcpy(netdev->name, pci_name(pdev));
strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
netdev->mem_start = mmio_start;
netdev->mem_end = mmio_start + mmio_len;
......
......@@ -437,7 +437,7 @@ ixgb_probe(struct pci_dev *pdev,
netdev->poll_controller = ixgb_netpoll;
#endif
strcpy(netdev->name, pci_name(pdev));
strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
netdev->mem_start = mmio_start;
netdev->mem_end = mmio_start + mmio_len;
netdev->base_addr = adapter->hw.io_base;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册