examples/fips_validation: fix buffer overflow
authorOlivier Matz <olivier.matz@6wind.com>
Tue, 6 Oct 2020 07:41:41 +0000 (09:41 +0200)
committerAkhil Goyal <akhil.goyal@nxp.com>
Wed, 14 Oct 2020 20:22:06 +0000 (22:22 +0200)
If the file name is larger than MAX_STRING_SIZE (64), strcpy()
will overwrite the content of memory.

Replace strcpy() by rte_strscpy(), check its return value, and
increase file_name size to 256.

Fixes: 3d0fad56b74a ("examples/fips_validation: add crypto FIPS application")
Cc: stable@dpdk.org
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
Acked-by: Fan Zhang <roy.fan.zhang@intel.com>
examples/fips_validation/fips_validation.c
examples/fips_validation/fips_validation.h

index 9bdf257..13f763c 100644 (file)
@@ -281,7 +281,11 @@ fips_test_init(const char *req_file_path, const char *rsp_file_path,
 
        fips_test_clear();
 
-       strcpy(info.file_name, req_file_path);
+       if (rte_strscpy(info.file_name, req_file_path,
+                               sizeof(info.file_name)) < 0) {
+               RTE_LOG(ERR, USER1, "Path %s too long\n", req_file_path);
+               return -EINVAL;
+       }
        info.algo = FIPS_TEST_ALGO_MAX;
        if (parse_file_type(req_file_path) < 0) {
                RTE_LOG(ERR, USER1, "File %s type not supported\n",
@@ -307,7 +311,11 @@ fips_test_init(const char *req_file_path, const char *rsp_file_path,
                return -ENOMEM;
        }
 
-       strlcpy(info.device_name, device_name, sizeof(info.device_name));
+       if (rte_strscpy(info.device_name, device_name,
+                               sizeof(info.device_name)) < 0) {
+               RTE_LOG(ERR, USER1, "Device name %s too long\n", device_name);
+               return -EINVAL;
+       }
 
        if (fips_test_parse_header() < 0) {
                RTE_LOG(ERR, USER1, "Failed parsing header\n");
index 75fa555..deba83e 100644 (file)
@@ -14,6 +14,7 @@
 #define MAX_NB_TESTS           10240
 #define MAX_BUF_SIZE           2048
 #define MAX_STRING_SIZE                64
+#define MAX_FILE_NAME_SIZE     256
 #define MAX_DIGEST_SIZE                64
 
 #define POSITIVE_TEST          0
@@ -164,7 +165,7 @@ struct fips_test_interim_info {
        uint32_t vec_start_off;
        uint32_t nb_vec_lines;
        char device_name[MAX_STRING_SIZE];
-       char file_name[MAX_STRING_SIZE];
+       char file_name[MAX_FILE_NAME_SIZE];
 
        union {
                struct aesavs_interim_data aes_data;