diff mbox series

[f2fs-dev] mkfs.f2fs: Fix out-of-bounds read in f2fs_prepare_super_block

Message ID 20240726223309.2102788-1-pcc@google.com (mailing list archive)
State New
Headers show
Series [f2fs-dev] mkfs.f2fs: Fix out-of-bounds read in f2fs_prepare_super_block | expand

Commit Message

Peter Collingbourne July 26, 2024, 10:33 p.m. UTC 
The path field in c.devices[i] is a pointer and is normally filled
in using strdup. This makes it invalid to copy MAX_PATH_LEN bytes
from it because the string may be shorter than that. Therefore,
fix the code to use strncpy to copy the string instead.

Signed-off-by: Peter Collingbourne <pcc@google.com>
---
 mkfs/f2fs_format.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/mkfs/f2fs_format.c b/mkfs/f2fs_format.c
index c9d335a..b053685 100644
--- a/mkfs/f2fs_format.c
+++ b/mkfs/f2fs_format.c
@@ -316,7 +316,7 @@  static int f2fs_prepare_super_block(void)
 					c.blks_per_seg - 1;
 		}
 		if (c.ndevs > 1) {
-			memcpy(sb->devs[i].path, c.devices[i].path, MAX_PATH_LEN);
+			strncpy((char *)sb->devs[i].path, c.devices[i].path, MAX_PATH_LEN);
 			sb->devs[i].total_segments =
 					cpu_to_le32(c.devices[i].total_segments);
 		}