diff options
| author | Andrew Goodbody <[email protected]> | 2025-07-23 11:34:35 +0100 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2025-07-29 13:14:46 -0600 |
| commit | 4b8aba93bdba168f284036cd7f8cb0e988bf3f92 (patch) | |
| tree | a1d2bcd09be92cf4c36a061c6a0a39519c800d2d /drivers/bios_emulator | |
| parent | bd0ade7d090a334b3986936d63a34001d99722ad (diff) | |
bios_emulator: Fix buffer overflow
Using strcpy to copy a 4 character string into a 4 byte field in a
structure will overflow that field as it writes the terminating \0 into
the following field. Correct this by using memcpy instead.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <[email protected]>
Diffstat (limited to 'drivers/bios_emulator')
| -rw-r--r-- | drivers/bios_emulator/atibios.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/bios_emulator/atibios.c b/drivers/bios_emulator/atibios.c index d544ffb5ffb..e992a1aa822 100644 --- a/drivers/bios_emulator/atibios.c +++ b/drivers/bios_emulator/atibios.c @@ -99,7 +99,7 @@ static int atibios_debug_mode(BE_VGAInfo *vga_info, RMREGS *regs, regs->e.edi = buffer_adr; info = buffer; memset(info, '\0', sizeof(*info)); - strcpy(info->signature, "VBE2"); + memcpy(info->signature, "VBE2", 4); BE_int86(0x10, regs, regs); if (regs->e.eax != 0x4f) { debug("VESA_GET_INFO: error %x\n", regs->e.eax); |