From 2d91798561e025606c82c54b5011e91be776eea2 Mon Sep 17 00:00:00 2001 From: "Juan A. Suarez Romero" Date: Thu, 20 Feb 2025 13:29:50 +0100 Subject: [PATCH] broadcom/simulator: use string copy instead of memcpy Using memcpy with the max size generates a global-buffer-overflow, as the performance counter strings are smaller than the max size. Instead, use a string copy function to get a copy. This was detected with address sanitizer enabled and running vulkaninfo. Fixes: 3e8b2fe053a ("broadcom/simulator: Add DRM_IOCTL_V3D_GET_COUNTER to simulator") Reviewed-by: Jose Maria Casanova Crespo Reviewed-by: Iago Toral Quiroga Signed-off-by: Juan A. Suarez Romero Part-of: --- src/broadcom/simulator/v3dx_simulator.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/broadcom/simulator/v3dx_simulator.c b/src/broadcom/simulator/v3dx_simulator.c index cddd7d941a9..f8630de045d 100644 --- a/src/broadcom/simulator/v3dx_simulator.c +++ b/src/broadcom/simulator/v3dx_simulator.c @@ -312,14 +312,14 @@ v3dX(simulator_perfmon_get_counter_ioctl)(uint32_t perfcnt_total, counter = v3d_performance_counters[args->counter]; - memcpy(args->name, counter[V3D_PERFCNT_NAME], - DRM_V3D_PERFCNT_MAX_NAME); + strncpy((char *)args->name, counter[V3D_PERFCNT_NAME], + DRM_V3D_PERFCNT_MAX_NAME); - memcpy(args->category, counter[V3D_PERFCNT_CATEGORY], - DRM_V3D_PERFCNT_MAX_CATEGORY); + strncpy((char *)args->category, counter[V3D_PERFCNT_CATEGORY], + DRM_V3D_PERFCNT_MAX_CATEGORY); - memcpy(args->description, counter[V3D_PERFCNT_DESCRIPTION], - DRM_V3D_PERFCNT_MAX_DESCRIPTION); + strncpy((char *)args->description, counter[V3D_PERFCNT_DESCRIPTION], + DRM_V3D_PERFCNT_MAX_DESCRIPTION); return 0; }