[dpdk-dev,v2,08/18] drivers/net/nfp: fix buffer overflow in fw_name
Checks
Commit Message
/home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c: In
function ‘nfp_pf_pci_probe’:
/home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c:3160:
23: error: ‘%s’ directive writing up to 99 bytes into a
region of size 76 [-Werror=format-overflow=]
sprintf(fw_name, "%s/%s.nffw", DEFAULT_FW_PATH, serial);
Signed-off-by: Andy Green <andy@warmcat.com>
---
drivers/net/nfp/nfp_net.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
On Wed, May 9, 2018 at 2:31 AM, Andy Green <andy@warmcat.com> wrote:
> /home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c: In
> function ‘nfp_pf_pci_probe’:
> /home/agreen/projects/dpdk/drivers/net/nfp/nfp_net.c:3160:
> 23: error: ‘%s’ directive writing up to 99 bytes into a
> region of size 76 [-Werror=format-overflow=]
> sprintf(fw_name, "%s/%s.nffw", DEFAULT_FW_PATH, serial);
>
> Signed-off-by: Andy Green <andy@warmcat.com>
> ---
> drivers/net/nfp/nfp_net.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/nfp/nfp_net.c b/drivers/net/nfp/nfp_net.c
> index 199aac40b..d5f0e54e8 100644
> --- a/drivers/net/nfp/nfp_net.c
> +++ b/drivers/net/nfp/nfp_net.c
> @@ -3144,7 +3144,7 @@ nfp_fw_upload(struct rte_pci_device *dev, struct
> nfp_nsp *nsp, char *card)
> struct nfp_cpp *cpp = nsp->cpp;
> int fw_f;
> char *fw_buf;
> - char fw_name[100];
> + char fw_name[130];
> char serial[100];
> struct stat file_stat;
> off_t fsize, bytes;
>
>
I would prefer to modify the serial char array size instead, and
considering the serial name is fixed, it can be set to 40 safely.
Thanks!
@@ -3144,7 +3144,7 @@ nfp_fw_upload(struct rte_pci_device *dev, struct nfp_nsp *nsp, char *card)
struct nfp_cpp *cpp = nsp->cpp;
int fw_f;
char *fw_buf;
- char fw_name[100];
+ char fw_name[130];
char serial[100];
struct stat file_stat;
off_t fsize, bytes;