4195c7de24
The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".
This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.
PR: 215474
Reported by: Coverity
CID: 1009997 1010000
|
||
---|---|---|
.. | ||
if_plip.c | ||
immio.c | ||
lpbb.c | ||
lpt.c | ||
lpt.h | ||
lptio.h | ||
pcfclock.c | ||
ppb_1284.c | ||
ppb_1284.h | ||
ppb_base.c | ||
ppb_msq.c | ||
ppb_msq.h | ||
ppbconf.c | ||
ppbconf.h | ||
ppbio.h | ||
ppbus_if.m | ||
ppi.c | ||
ppi.h | ||
pps.c | ||
vpo.c | ||
vpoio.c | ||
vpoio.h |