diff mbox series

[1/3] examples/fips_validation: fix buffer overflow

Message ID 20201006074143.31691-2-olivier.matz@6wind.com (mailing list archive)
State Accepted, archived
Delegated to: akhil goyal
Headers
Series examples/fips_validation: misc fixes |

Checks

Context Check Description
ci/checkpatch success coding style OK

Commit Message

Olivier Matz Oct. 6, 2020, 7:41 a.m. UTC 
  If the file name is larger than MAX_STRING_SIZE (64), strcpy()
will overwrite the content of memory.

Replace strcpy() by rte_strscpy(), check its return value, and
increase file_name size to 256.

Fixes: 3d0fad56b74a ("examples/fips_validation: add crypto FIPS application")
Cc: stable@dpdk.org

Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
---
 examples/fips_validation/fips_validation.c | 12 ++++++++++--
 examples/fips_validation/fips_validation.h |  3 ++-
 2 files changed, 12 insertions(+), 3 deletions(-)

Comments

Fan Zhang Oct. 6, 2020, 8:48 a.m. UTC | #1 
> -----Original Message-----
> From: Olivier Matz <olivier.matz@6wind.com>
> Sent: Tuesday, October 6, 2020 8:42 AM
> To: dev@dpdk.org
> Cc: Kovacevic, Marko <marko.kovacevic@intel.com>; Akhil Goyal
> <akhil.goyal@nxp.com>; Zhang, Roy Fan <roy.fan.zhang@intel.com>; Kusztal,
> ArkadiuszX <arkadiuszx.kusztal@intel.com>; stable@dpdk.org
> Subject: [PATCH 1/3] examples/fips_validation: fix buffer overflow
> 
> If the file name is larger than MAX_STRING_SIZE (64), strcpy()
> will overwrite the content of memory.
> 
> Replace strcpy() by rte_strscpy(), check its return value, and
> increase file_name size to 256.
> 
> Fixes: 3d0fad56b74a ("examples/fips_validation: add crypto FIPS application")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
> ---

Acked-by: Fan Zhang <roy.fan.zhang@intel.com>
diff mbox series

Patch

diff --git a/examples/fips_validation/fips_validation.c b/examples/fips_validation/fips_validation.c
index 9bdf257b8b..13f763c9aa 100644
--- a/examples/fips_validation/fips_validation.c
+++ b/examples/fips_validation/fips_validation.c
@@ -281,7 +281,11 @@  fips_test_init(const char *req_file_path, const char *rsp_file_path,
 
 	fips_test_clear();
 
-	strcpy(info.file_name, req_file_path);
+	if (rte_strscpy(info.file_name, req_file_path,
+				sizeof(info.file_name)) < 0) {
+		RTE_LOG(ERR, USER1, "Path %s too long\n", req_file_path);
+		return -EINVAL;
+	}
 	info.algo = FIPS_TEST_ALGO_MAX;
 	if (parse_file_type(req_file_path) < 0) {
 		RTE_LOG(ERR, USER1, "File %s type not supported\n",
@@ -307,7 +311,11 @@  fips_test_init(const char *req_file_path, const char *rsp_file_path,
 		return -ENOMEM;
 	}
 
-	strlcpy(info.device_name, device_name, sizeof(info.device_name));
+	if (rte_strscpy(info.device_name, device_name,
+				sizeof(info.device_name)) < 0) {
+		RTE_LOG(ERR, USER1, "Device name %s too long\n", device_name);
+		return -EINVAL;
+	}
 
 	if (fips_test_parse_header() < 0) {
 		RTE_LOG(ERR, USER1, "Failed parsing header\n");
diff --git a/examples/fips_validation/fips_validation.h b/examples/fips_validation/fips_validation.h
index 75fa555fa6..deba83eada 100644
--- a/examples/fips_validation/fips_validation.h
+++ b/examples/fips_validation/fips_validation.h
@@ -14,6 +14,7 @@ 
 #define MAX_NB_TESTS		10240
 #define MAX_BUF_SIZE		2048
 #define MAX_STRING_SIZE		64
+#define MAX_FILE_NAME_SIZE	256
 #define MAX_DIGEST_SIZE		64
 
 #define POSITIVE_TEST		0
@@ -164,7 +165,7 @@  struct fips_test_interim_info {
 	uint32_t vec_start_off;
 	uint32_t nb_vec_lines;
 	char device_name[MAX_STRING_SIZE];
-	char file_name[MAX_STRING_SIZE];
+	char file_name[MAX_FILE_NAME_SIZE];
 
 	union {
 		struct aesavs_interim_data aes_data;