The way virStrncpy() is called here will never result in
buffer overflow, but it won't prevent or detect truncation
either, despite what the error message might suggest. Use
virStrcpyStatic(), which does all of the above, instead.

Signed-off-by: Andrea Bolognani <abolo...@redhat.com>
---
 src/esx/esx_driver.c       | 4 +---
 src/hyperv/hyperv_driver.c | 3 +--
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c
index 947b7c1a31..edd21b9d28 100644
--- a/src/esx/esx_driver.c
+++ b/src/esx/esx_driver.c
@@ -1317,9 +1317,7 @@ esxNodeGetInfo(virConnectPtr conn, virNodeInfoPtr 
nodeinfo)
                 ++ptr;
             }
 
-            if (!virStrncpy(nodeinfo->model, dynamicProperty->val->string,
-                            sizeof(nodeinfo->model) - 1,
-                            sizeof(nodeinfo->model))) {
+            if (!virStrcpyStatic(nodeinfo->model, 
dynamicProperty->val->string)) {
                 virReportError(VIR_ERR_INTERNAL_ERROR,
                                _("CPU Model %s too long for destination"),
                                dynamicProperty->val->string);
diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c
index a85943668c..6f74adf372 100644
--- a/src/hyperv/hyperv_driver.c
+++ b/src/hyperv/hyperv_driver.c
@@ -307,8 +307,7 @@ hypervNodeGetInfo(virConnectPtr conn, virNodeInfoPtr info)
     }
 
     /* Fill struct */
-    if (virStrncpy(info->model, processorList->data.common->Name,
-                   sizeof(info->model) - 1, sizeof(info->model)) == NULL) {
+    if (virStrcpyStatic(info->model, processorList->data.common->Name) == 
NULL) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
                        _("CPU model %s too long for destination"),
                        processorList->data.common->Name);
-- 
2.17.1

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Reply via email to