From c5a4428a783d173721ad0ed5486d058976737af8 Mon Sep 17 00:00:00 2001 From: Olivier Matz Date: Mon, 13 Jul 2020 11:36:54 +0200 Subject: [PATCH] examples/fips_validation: fix buffer overflow If the file name is larger than MAX_STRING_SIZE (64), strcpy() will overwrite the content of memory. Replace strcpy() by rte_strscpy(), check its return value, and increase file_name size to 256. Fixes: 3d0fad56b74a ("examples/fips_validation: add crypto FIPS application") Signed-off-by: Olivier Matz --- examples/fips_validation/fips_validation.c | 12 ++++++++++-- examples/fips_validation/fips_validation.h | 3 ++- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/examples/fips_validation/fips_validation.c b/examples/fips_validation/fips_validation.c index 9bdf257b8b..13f763c9aa 100644 --- a/examples/fips_validation/fips_validation.c +++ b/examples/fips_validation/fips_validation.c @@ -281,7 +281,11 @@ fips_test_init(const char *req_file_path, const char *rsp_file_path, fips_test_clear(); - strcpy(info.file_name, req_file_path); + if (rte_strscpy(info.file_name, req_file_path, + sizeof(info.file_name)) < 0) { + RTE_LOG(ERR, USER1, "Path %s too long\n", req_file_path); + return -EINVAL; + } info.algo = FIPS_TEST_ALGO_MAX; if (parse_file_type(req_file_path) < 0) { RTE_LOG(ERR, USER1, "File %s type not supported\n", @@ -307,7 +311,11 @@ fips_test_init(const char *req_file_path, const char *rsp_file_path, return -ENOMEM; } - strlcpy(info.device_name, device_name, sizeof(info.device_name)); + if (rte_strscpy(info.device_name, device_name, + sizeof(info.device_name)) < 0) { + RTE_LOG(ERR, USER1, "Device name %s too long\n", device_name); + return -EINVAL; + } if (fips_test_parse_header() < 0) { RTE_LOG(ERR, USER1, "Failed parsing header\n"); diff --git a/examples/fips_validation/fips_validation.h b/examples/fips_validation/fips_validation.h index 75fa555fa6..deba83eada 100644 --- a/examples/fips_validation/fips_validation.h +++ b/examples/fips_validation/fips_validation.h @@ -14,6 +14,7 @@ #define MAX_NB_TESTS 10240 #define MAX_BUF_SIZE 2048 #define MAX_STRING_SIZE 64 +#define MAX_FILE_NAME_SIZE 256 #define MAX_DIGEST_SIZE 64 #define POSITIVE_TEST 0 @@ -164,7 +165,7 @@ struct fips_test_interim_info { uint32_t vec_start_off; uint32_t nb_vec_lines; char device_name[MAX_STRING_SIZE]; - char file_name[MAX_STRING_SIZE]; + char file_name[MAX_FILE_NAME_SIZE]; union { struct aesavs_interim_data aes_data; -- 2.20.1