[edk2] [efibootmgr PATCH 6/7] prevent out-of-bounds access with SCSI_IOCTL_GET_PCI

[Laszlo Ersek]

SCSI_IOCTL_GET_PCI can store up to 20 non-NUL characters, and it doesn't
store a NUL character at all.

Signed-off-by: Laszlo Ersek <ler...@redhat.com>
---
 src/include/scsi_ioctls.h |    6 +++++-
 src/lib/disk.c            |    4 ++--
 src/lib/scsi_ioctls.c     |   17 ++++++++++++-----
 3 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/src/include/scsi_ioctls.h b/src/include/scsi_ioctls.h
index 558824f..ba4c8bb 100644
--- a/src/include/scsi_ioctls.h
+++ b/src/include/scsi_ioctls.h
@@ -22,12 +22,16 @@
 #define _SCSI_IOCTLS_H 
 
 #include <stdint.h>
+#include <stddef.h>
 
 
 /* Snagged from linux/include/scsi/scsi.h */
 #define SCSI_IOCTL_GET_IDLUN 0x5382
 #define SCSI_IOCTL_GET_PCI   0x5387
 
+/* see scsi_ioctl_get_pci() in linux/drivers/scsi/scsi_ioctl.c */
+#define SLOT_NAME_SIZE ((size_t)21)
+
 typedef struct scsi_idlun {
        uint32_t dev_id;
        uint32_t host_unique_id;
@@ -35,7 +39,7 @@ typedef struct scsi_idlun {
 
 
 inline int get_scsi_idlun(int fd, Scsi_Idlun *idlun);
-inline int get_scsi_pci(int fd, char *slot_name);
+int get_scsi_pci(int fd, char *slot_name, size_t size);
 int idlun_to_components (Scsi_Idlun *idlun,
                         unsigned char *host,
                         unsigned char *channel,
diff --git a/src/lib/disk.c b/src/lib/disk.c
index f592db6..c82ac80 100644
--- a/src/lib/disk.c
+++ b/src/lib/disk.c
@@ -209,7 +209,7 @@ disk_get_scsi_pci(int fd,
 {
        int rc, usefd=fd;
        struct stat buf;
-       char slot_name[8];
+       char slot_name[SLOT_NAME_SIZE];
        unsigned int b=0,d=0,f=0;
        memset(&buf, 0, sizeof(buf));
        rc = fstat(fd, &buf);
@@ -227,7 +227,7 @@ disk_get_scsi_pci(int fd,
                return 1;
        }
 
-       rc = get_scsi_pci(usefd, slot_name);
+       rc = get_scsi_pci(usefd, slot_name, sizeof slot_name);
        if (rc) {
                perror("get_scsi_pci");
                return rc;
diff --git a/src/lib/scsi_ioctls.c b/src/lib/scsi_ioctls.c
index c19cef3..deb61bd 100644
--- a/src/lib/scsi_ioctls.c
+++ b/src/lib/scsi_ioctls.c
@@ -49,10 +49,17 @@ get_scsi_idlun(int fd, Scsi_Idlun *idlun)
        return ioctl(fd, SCSI_IOCTL_GET_IDLUN, idlun);
 }
 
-inline int 
-get_scsi_pci(int fd, char *slot_name)
+int
+get_scsi_pci(int fd, char *slot_name, size_t size)
 {
-       return ioctl(fd, SCSI_IOCTL_GET_PCI, slot_name);
+       char buf[SLOT_NAME_SIZE] = "";
+       int rc;
+
+       rc = ioctl(fd, SCSI_IOCTL_GET_PCI, buf);
+       if (rc == 0) {
+               snprintf(slot_name, size, "%s", buf);
+       }
+       return rc;
 }
 
 
@@ -68,7 +75,7 @@ usage(char **argv)
 int main(int argc, char **argv)
 {
        Scsi_Idlun idlun;
-       char slot_name[8];
+       char slot_name[SLOT_NAME_SIZE] = "unknown";
        int fd = 0, rc = 0;
 
        memset(&idlun, 0, sizeof(idlun));
@@ -81,7 +88,7 @@ int main(int argc, char **argv)
                exit(1);
        }
 
-       rc = get_scsi_pci(fd, slot_name);
+       rc = get_scsi_pci(fd, slot_name, sizeof slot_name);
        if (rc) {
                perror("Unable to get_scsi_pci()");
        }
-- 
1.7.1



------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and 
AppDynamics. Performance Central is your source for news, insights, 
analysis and resources for efficient Application Performance Management. 
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/edk2-devel