summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorAuke Kok <auke\-jan.h.kok@intel.com>2006-09-27 12:53:17 -0700
committerAuke Kok <juke-jan.h.kok@intel.com>2006-09-27 12:53:17 -0700
commit0eb5a34cdf34ad07b6db2df1e523aaf6574601b4 (patch)
tree75d2086eb9601bb2374b0d7575b12484ed189748 /drivers
parent0abb6eb12806cf99ea815810d470423083c3b9f4 (diff)
e100, e1000, ixgb: Fix an impossible memory overwrite bug
We keep getting requests from people that think that this might be an exploitable hole where we would overwrite 4 bytes in the netdev struct if the pci name would exceed 15 characters. In reality this will never happen but we fix it anyway. Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/e100.c2
-rw-r--r--drivers/net/e1000/e1000_main.c2
-rw-r--r--drivers/net/ixgb/ixgb_main.c2
3 files changed, 3 insertions, 3 deletions
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index d9750e269a56..ab0868cb120c 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2572,7 +2572,7 @@ static int __devinit e100_probe(struct pci_dev *pdev,
#ifdef CONFIG_NET_POLL_CONTROLLER
netdev->poll_controller = e100_netpoll;
#endif
- strcpy(netdev->name, pci_name(pdev));
+ strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
nic = netdev_priv(netdev);
nic->netdev = netdev;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 082c02918a41..bd673802e8ce 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -759,7 +759,7 @@ e1000_probe(struct pci_dev *pdev,
#ifdef CONFIG_NET_POLL_CONTROLLER
netdev->poll_controller = e1000_netpoll;
#endif
- strcpy(netdev->name, pci_name(pdev));
+ strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
netdev->mem_start = mmio_start;
netdev->mem_end = mmio_start + mmio_len;
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index a88c2b8b66b1..fb4c1ad745b2 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -437,7 +437,7 @@ ixgb_probe(struct pci_dev *pdev,
netdev->poll_controller = ixgb_netpoll;
#endif
- strcpy(netdev->name, pci_name(pdev));
+ strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
netdev->mem_start = mmio_start;
netdev->mem_end = mmio_start + mmio_len;
netdev->base_addr = adapter->hw.io_base;