• R/O
  • HTTP
  • SSH
  • HTTPS

Commit

Tags
No Tags

Frequently used words (click to add to your profile)

javac++androidlinuxc#windowsobjective-ccocoa誰得qtpythonphprubygameguibathyscaphec計画中(planning stage)翻訳omegatframeworktwitterdomtestvb.netdirectxゲームエンジンbtronarduinopreviewer

hardware/intel/common/libva


Commit MetaInfo

Revisión8e890e3a0a5c91ba921d9fbedc532c596ff46dd1 (tree)
Tiempo2018-12-20 12:45:09
AutorVíctor Manuel Jáquez Leal <vjaquez@igal...>
CommiterXinfengZhang

Log Message

av: avoid driver path truncation

Using strncat() and strncpy() may lead to string truncation, which
might generate other issues.

This patch replaces the usage of strncat() and strncpy() to generate
the driver path, with snprintf() safetly.

See more information here:
https://developers.redhat.com/blog/2018/05/24/detecting-string-truncation-with-gcc-8/

Cambiar Resumen

Diferencia incremental

--- a/va/va.c
+++ b/va/va.c
@@ -349,6 +349,23 @@ static VAStatus va_getDriverName(VADisplay dpy, char **driver_name)
349349 return pDisplayContext->vaGetDriverName(pDisplayContext, driver_name);
350350 }
351351
352+static char *va_getDriverPath(const char *driver_dir, const char *driver_name)
353+{
354+ int n = snprintf(0, 0, "%s/%s%s", driver_dir, driver_name, DRIVER_EXTENSION);
355+ if (n < 0)
356+ return NULL;
357+ char *driver_path = (char *) malloc(n + 1);
358+ if (!driver_path)
359+ return NULL;
360+ n = snprintf(driver_path, n + 1, "%s/%s%s",
361+ driver_dir, driver_name, DRIVER_EXTENSION);
362+ if (n < 0) {
363+ free(driver_path);
364+ return NULL;
365+ }
366+ return driver_path;
367+}
368+
352369 static VAStatus va_openDriver(VADisplay dpy, char *driver_name)
353370 {
354371 VADriverContextP ctx = CTX(dpy);
@@ -367,9 +384,7 @@ static VAStatus va_openDriver(VADisplay dpy, char *driver_name)
367384 driver_dir = strtok_r(search_path, ":", &saveptr);
368385 while (driver_dir) {
369386 void *handle = NULL;
370- char *driver_path = (char *) malloc( strlen(driver_dir) +
371- strlen(driver_name) +
372- strlen(DRIVER_EXTENSION) + 2 );
387+ char *driver_path = va_getDriverPath(driver_dir, driver_name);
373388 if (!driver_path) {
374389 va_errorMessage(dpy, "%s L%d Out of memory!n",
375390 __FUNCTION__, __LINE__);
@@ -377,11 +392,6 @@ static VAStatus va_openDriver(VADisplay dpy, char *driver_name)
377392 return VA_STATUS_ERROR_ALLOCATION_FAILED;
378393 }
379394
380- strncpy( driver_path, driver_dir, strlen(driver_dir) + 1);
381- strncat( driver_path, "/", strlen("/") );
382- strncat( driver_path, driver_name, strlen(driver_name) );
383- strncat( driver_path, DRIVER_EXTENSION, strlen(DRIVER_EXTENSION) );
384-
385395 va_infoMessage(dpy, "Trying to open %s\n", driver_path);
386396 #ifndef ANDROID
387397 handle = dlopen( driver_path, RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE );