From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by dpdk.org (Postfix) with ESMTP id 87F212BEF for ; Mon, 11 Apr 2016 18:03:57 +0200 (CEST) Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga103.fm.intel.com with ESMTP; 11 Apr 2016 09:03:57 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.24,462,1455004800"; d="scan'208";a="956299965" Received: from unknown (HELO Sent) ([10.217.248.18]) by fmsmga002.fm.intel.com with SMTP; 11 Apr 2016 09:03:53 -0700 Received: by Sent (sSMTP sendmail emulation); Mon, 11 Apr 2016 18:03:50 +0200 From: Tomasz Kulasek To: dev@dpdk.org Date: Mon, 11 Apr 2016 18:03:48 +0200 Message-Id: <1460390628-4716-1-git-send-email-tomaszx.kulasek@intel.com> X-Mailer: git-send-email 2.1.4 Subject: [dpdk-dev] [PATCH] app/testpmd: fix strcat can overrun fixed-size string X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Apr 2016 16:03:58 -0000 CID 13307 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW) fixed_size_dest: You might overrun the 128 byte fixed-size string fwd_modes by copying fwd_eng->fwd_mode_name without checking the length. Fixes: 769ce6b17835 ("app/testpmd: list forwarding engines") Signed-off-by: Tomasz Kulasek --- app/test-pmd/config.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/app/test-pmd/config.c b/app/test-pmd/config.c index b1bbec6..fff2d96 100644 --- a/app/test-pmd/config.c +++ b/app/test-pmd/config.c @@ -1673,8 +1673,10 @@ list_pkt_forwarding_modes(void) if (strlen (fwd_modes) == 0) { while ((fwd_eng = fwd_engines[i++]) != NULL) { - strcat(fwd_modes, fwd_eng->fwd_mode_name); - strcat(fwd_modes, separator); + strncat(fwd_modes, fwd_eng->fwd_mode_name, sizeof(fwd_modes) - + strlen(fwd_modes) - 1); + strncat(fwd_modes, separator, sizeof(fwd_modes) - strlen(fwd_modes) + - 1); } fwd_modes[strlen(fwd_modes) - strlen(separator)] = '\0'; } -- 1.7.9.5