hardware/intel/common/libva
修訂 | 8e890e3a0a5c91ba921d9fbedc532c596ff46dd1 (tree) |
---|---|
時間 | 2018-12-20 12:45:09 |
作者 | Víctor Manuel Jáquez Leal <vjaquez@igal...> |
Commiter | XinfengZhang |
av: avoid driver path truncation
Using strncat() and strncpy() may lead to string truncation, which
might generate other issues.
This patch replaces the usage of strncat() and strncpy() to generate
the driver path, with snprintf() safetly.
See more information here:
https://developers.redhat.com/blog/2018/05/24/detecting-string-truncation-with-gcc-8/
@@ -349,6 +349,23 @@ static VAStatus va_getDriverName(VADisplay dpy, char **driver_name) | ||
349 | 349 | return pDisplayContext->vaGetDriverName(pDisplayContext, driver_name); |
350 | 350 | } |
351 | 351 | |
352 | +static char *va_getDriverPath(const char *driver_dir, const char *driver_name) | |
353 | +{ | |
354 | + int n = snprintf(0, 0, "%s/%s%s", driver_dir, driver_name, DRIVER_EXTENSION); | |
355 | + if (n < 0) | |
356 | + return NULL; | |
357 | + char *driver_path = (char *) malloc(n + 1); | |
358 | + if (!driver_path) | |
359 | + return NULL; | |
360 | + n = snprintf(driver_path, n + 1, "%s/%s%s", | |
361 | + driver_dir, driver_name, DRIVER_EXTENSION); | |
362 | + if (n < 0) { | |
363 | + free(driver_path); | |
364 | + return NULL; | |
365 | + } | |
366 | + return driver_path; | |
367 | +} | |
368 | + | |
352 | 369 | static VAStatus va_openDriver(VADisplay dpy, char *driver_name) |
353 | 370 | { |
354 | 371 | VADriverContextP ctx = CTX(dpy); |
@@ -367,9 +384,7 @@ static VAStatus va_openDriver(VADisplay dpy, char *driver_name) | ||
367 | 384 | driver_dir = strtok_r(search_path, ":", &saveptr); |
368 | 385 | while (driver_dir) { |
369 | 386 | void *handle = NULL; |
370 | - char *driver_path = (char *) malloc( strlen(driver_dir) + | |
371 | - strlen(driver_name) + | |
372 | - strlen(DRIVER_EXTENSION) + 2 ); | |
387 | + char *driver_path = va_getDriverPath(driver_dir, driver_name); | |
373 | 388 | if (!driver_path) { |
374 | 389 | va_errorMessage(dpy, "%s L%d Out of memory!n", |
375 | 390 | __FUNCTION__, __LINE__); |
@@ -377,11 +392,6 @@ static VAStatus va_openDriver(VADisplay dpy, char *driver_name) | ||
377 | 392 | return VA_STATUS_ERROR_ALLOCATION_FAILED; |
378 | 393 | } |
379 | 394 | |
380 | - strncpy( driver_path, driver_dir, strlen(driver_dir) + 1); | |
381 | - strncat( driver_path, "/", strlen("/") ); | |
382 | - strncat( driver_path, driver_name, strlen(driver_name) ); | |
383 | - strncat( driver_path, DRIVER_EXTENSION, strlen(DRIVER_EXTENSION) ); | |
384 | - | |
385 | 395 | va_infoMessage(dpy, "Trying to open %s\n", driver_path); |
386 | 396 | #ifndef ANDROID |
387 | 397 | handle = dlopen( driver_path, RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE ); |