AlexIndustrial/mesa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

broadcom/simulator: use string copy instead of memcpy

Browse Source 
Using memcpy with the max size generates a global-buffer-overflow, as
the performance counter strings are smaller than the max size.

Instead, use a string copy function to get a copy.

This was detected with address sanitizer enabled and running vulkaninfo.

Fixes: 3e8b2fe053 ("broadcom/simulator: Add DRM_IOCTL_V3D_GET_COUNTER to simulator")
Reviewed-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Signed-off-by: Juan A. Suarez Romero <jasuarez@igalia.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/33627>
This commit is contained in:
Juan A. Suarez Romero
2025-02-20 13:29:50 +01:00
committed by Marge Bot
parent 351bf1e524
commit 2d91798561
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/broadcom/simulator/v3dx_simulator.c
+6 -6
View File
@@ -312,14 +312,14 @@ v3dX(simulator_perfmon_get_counter_ioctl)(uint32_t perfcnt_total,
counter = v3d_performance_counters[args->counter];
memcpy(args->name, counter[V3D_PERFCNT_NAME],
DRM_V3D_PERFCNT_MAX_NAME);
strncpy((char *)args->name, counter[V3D_PERFCNT_NAME],
DRM_V3D_PERFCNT_MAX_NAME);
memcpy(args->category, counter[V3D_PERFCNT_CATEGORY],
DRM_V3D_PERFCNT_MAX_CATEGORY);
strncpy((char *)args->category, counter[V3D_PERFCNT_CATEGORY],
DRM_V3D_PERFCNT_MAX_CATEGORY);
memcpy(args->description, counter[V3D_PERFCNT_DESCRIPTION],
DRM_V3D_PERFCNT_MAX_DESCRIPTION);
strncpy((char *)args->description, counter[V3D_PERFCNT_DESCRIPTION],
DRM_V3D_PERFCNT_MAX_DESCRIPTION);
return 0;
}