From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by dpdk.org (Postfix) with ESMTP id 09ACC27D; Fri, 8 Mar 2019 15:02:12 +0100 (CET) X-Amp-Result: UNSCANNABLE X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Mar 2019 06:02:11 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.58,456,1544515200"; d="scan'208";a="139149048" Received: from bricha3-mobl.ger.corp.intel.com ([10.237.221.36]) by FMSMGA003.fm.intel.com with SMTP; 08 Mar 2019 06:02:07 -0800 Received: by (sSMTP sendmail emulation); Fri, 08 Mar 2019 14:02:05 +0000 Date: Fri, 8 Mar 2019 14:02:05 +0000 From: Bruce Richardson To: Chaitanya Babu Talluri Cc: dev@dpdk.org, reshma.pattan@intel.com, jananeex.m.parthasarathy@intel.com, cristian.dumitrescu@intel.com, ferruh.yigit@intel.com, stable@dpdk.org Message-ID: <20190308140205.GA689548@bricha3-MOBL.ger.corp.intel.com> References: <1550136631-32415-1-git-send-email-tallurix.chaitanya.babu@intel.com> <1552049150-5046-1-git-send-email-tallurix.chaitanya.babu@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1552049150-5046-1-git-send-email-tallurix.chaitanya.babu@intel.com> User-Agent: Mutt/1.11.2 (2019-01-07) Subject: Re: [dpdk-stable] [PATCH v2] lib/cfgfile: replace strcat with strlcat X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2019 14:02:13 -0000 On Fri, Mar 08, 2019 at 12:45:50PM +0000, Chaitanya Babu Talluri wrote: > Replace strcat with strlcat to avoid buffer overflow. > > Fixes: a6a47ac9c2 ("cfgfile: rework load function") > Cc: stable@dpdk.org > > Signed-off-by: Chaitanya Babu Talluri > --- > v2: Instead of strcat, used strlcat. > --- > lib/librte_cfgfile/rte_cfgfile.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/lib/librte_cfgfile/rte_cfgfile.c b/lib/librte_cfgfile/rte_cfgfile.c > index 7d8c941ea..3296bb6f8 100644 > --- a/lib/librte_cfgfile/rte_cfgfile.c > +++ b/lib/librte_cfgfile/rte_cfgfile.c > @@ -8,6 +8,7 @@ > #include > #include > #include > +#include > > #include "rte_cfgfile.h" > > @@ -224,10 +225,11 @@ rte_cfgfile_load_with_params(const char *filename, int flags, > _strip(split[1], strlen(split[1])); > char *end = memchr(split[1], '\\', strlen(split[1])); > > + size_t split_len = strlen(split[1]) + 1; > while (end != NULL) { > if (*(end+1) == params->comment_character) { > *end = '\0'; > - strcat(split[1], end+1); > + strlcat(split[1], end+1, split_len); I don't think this will do what you want. Remember that strlcat takes the total length of the buffer, which means that if split_len is set to the current length (as you do before the while statement), then passing that as the length parameter will cause strlcat to do nothing, since it sees the buffer as already full. /Bruce