[Beignet] [PATCH 05/12] file name length overflow check.

[xionghu . luo]

From: Luo Xionghu <xionghu....@intel.com>

Signed-off-by: Luo Xionghu <xionghu....@intel.com>
---
 backend/src/backend/gen_insn_selection_output.cpp |  8 +++++++-
 src/cl_program.c                                  | 12 +++++++++---
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/backend/src/backend/gen_insn_selection_output.cpp 
b/backend/src/backend/gen_insn_selection_output.cpp
index 1861637..ed26650 100644
--- a/backend/src/backend/gen_insn_selection_output.cpp
+++ b/backend/src/backend/gen_insn_selection_output.cpp
@@ -95,13 +95,14 @@ namespace gbe
       assert(!"should not reach here");
   }
 
+#define OP_NAME_LENGTH 512
   void outputSelectionIR(GenContext &ctx, Selection* sel)
   {
     cout << "SELECTION IR begin:" << endl;
     cout << "WARNING: not completed yet, welcome for the FIX!" << endl;
     for (SelectionBlock &block : *sel->blockList) {
       for (SelectionInstruction &insn : block.insnList) {
-        char opname[512];
+        char opname[OP_NAME_LENGTH];
         if (insn.isLabel()) {
             cout << "  L" << insn.index << ":" << endl;
             continue;
@@ -137,6 +138,11 @@ namespace gbe
         }
 
         int n = strlen(opname);
+        if(n >= OP_NAME_LENGTH - 20) {
+          cout << "opname too long: " << opname << endl;
+          return;
+        }
+
         sprintf(&opname[n], "(%d)", insn.state.execWidth);
         cout << "    " << left << setw(20) << opname;
 
diff --git a/src/cl_program.c b/src/cl_program.c
index b4656ce..51d6318 100644
--- a/src/cl_program.c
+++ b/src/cl_program.c
@@ -745,6 +745,7 @@ error:
   return p;
 }
 
+#define FILE_PATH_LENGTH  1024
 LOCAL cl_int
 cl_program_compile(cl_program            p,
                    cl_uint               num_input_headers,
@@ -795,11 +796,15 @@ cl_program_compile(cl_program            p,
     for (i = 0; i < num_input_headers; i++) {
       if(header_include_names[i] == NULL || input_headers[i] == NULL)
         continue;
-
-      char temp_path[255]="";
-      strncpy(temp_path, temp_header_path, strlen(temp_header_path));
+      char temp_path[FILE_PATH_LENGTH]="";
+      strncat(temp_path, temp_header_path, strlen(temp_header_path));
       strncat(temp_path, "/", 1);
       strncat(temp_path, header_include_names[i], 
strlen(header_include_names[i]));
+      if(strlen(temp_path) >= FILE_PATH_LENGTH - 1 ) {
+        err = CL_COMPILE_PROGRAM_FAILURE;
+        goto error;
+      }
+      temp_path[strlen(temp_path)+1] = '\0';
       char* dirc = strdup(temp_path);
       char* dir = dirname(dirc);
       mkdir(dir, 0755);
@@ -943,6 +948,7 @@ cl_program_get_kernel_names(cl_program p, size_t size, char 
*names, size_t *size
   len = strlen(ker_name);
   if(names) {
     strncpy(names, cl_kernel_get_name(p->ker[0]), size - 1);
+    names[size] = '\0';
     if(size < len - 1) {
       if(size_ret) *size_ret = size;
       return;
-- 
2.1.4

_______________________________________________
Beignet mailing list
Beignet@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/beignet