lib/libgpiod
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git synced 2026-10-24 00:48:53 +03:00
Code Activity

core: fix 1-byte buffer over-read bugs in gpiod_chip_info_from_uapi()

Browse Source 
The copy in gpiod_chip_info_from_uapi() uses sizeof(info->name) = 33 as
the strncpy length while it should read at most GPIO_MAX_NAME_SIZE = 32.
Same for info->label. 33 is the size of the target buffer where we
allocate an additional byte for the NULL-terminator. Limit the number of
read bytes to the correct value.

Fixes: b7ba732e6a ("treewide: libgpiod v2 implementation")
Reported-by: 4fqr <4fqr@proton.me>
Tested-by: Vincent Fazio <vfazio@xes-inc.com>
Reviewed-by: Vincent Fazio <vfazio@xes-inc.com>
Link: https://patch.msgid.link/20260407-treewide-fixes-v1-3-66c9744a56a3@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
This commit is contained in:
Bartosz Golaszewski
2026-04-07 14:49:54 +02:00
parent a2c92c9ece
commit c040d4e15e
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/chip-info.c
View File

@@ -57,7 +57,7 @@ gpiod_chip_info_from_uapi(struct gpiochip_info *uapi_info)
* GPIO device must have a name - don't bother checking this field. In
* the worst case (would have to be a weird kernel bug) it'll be empty.
*/
strncpy(info->name, uapi_info->name, sizeof(info->name));
strncpy(info->name, uapi_info->name, GPIO_MAX_NAME_SIZE);
/*
* The kernel sets the label of a GPIO device to "unknown" if it
@@ -65,9 +65,9 @@ gpiod_chip_info_from_uapi(struct gpiochip_info *uapi_info)
* we got an empty string, do the same.
*/
if (uapi_info->label[0] == '\0')
strncpy(info->label, "unknown", sizeof(info->label));
strncpy(info->label, "unknown", GPIO_MAX_NAME_SIZE);
else
strncpy(info->label, uapi_info->label, sizeof(info->label));
strncpy(info->label, uapi_info->label, GPIO_MAX_NAME_SIZE);
return info;
}