diff options
| author |   Tianyu Li <tianyu.li@arm.com> | 2023-07-12 05:51:42 +0000 |
|---|---|---|
| committer |   Dave Wallace <dwallacelf@gmail.com> | 2024-01-12 03:22:56 +0000 |
| commit | d7c96324c0fc7e23cd901c6166f1a7dba3e5b896 (patch) | |
| tree | 99d66d97e6f91078fb653a2d8f8a810191e4e8d3 /extras | |
| parent | 00e9fe6ca771bfbe7ee62e80a44903ffb227cae2 (diff) | |
libmemif: fix segfault and buffer overflow in examples
- Fix buffer overflow caused by strncpy(dst, src, strlen(src)),
use sized buffer to ensure overflow safe.
- Fix test_app getopt usage
When use example/icmp_responder in slave mode
- Fix segfault when buffer size is not specified
- Fix wrong packet send out.
Type: fix
Signed-off-by: Tianyu Li <tianyu.li@arm.com>
Change-Id: I5ed47fd8e630420d7ae0203a2605d2b9abd33d2a
Diffstat (limited to 'extras')
| -rw-r--r-- | extras/libmemif/examples/common/packet_handler.c | 2 | ||||
| -rw-r--r-- | extras/libmemif/examples/icmp_responder/main.c | 4 | ||||
| -rw-r--r-- | extras/libmemif/examples/test_app/main.c | 4 |
3 files changed, 6 insertions, 4 deletions
diff --git a/extras/libmemif/examples/common/packet_handler.c b/extras/libmemif/examples/common/packet_handler.c index 9d3e4d703c1..1e97e46dba2 100644 --- a/extras/libmemif/examples/common/packet_handler.c +++ b/extras/libmemif/examples/common/packet_handler.c @@ -48,7 +48,7 @@ icmp_packet_handler (memif_connection_t *c) for (i = 0; i < c->tx_buf_num; i++) { uint32_t len; - void *packet = c->rx_bufs[i].data; + void *packet = c->tx_bufs[i].data; memcpy (c->tx_bufs[i].data, c->rx_bufs[i].data, c->rx_bufs[i].len); c->tx_bufs[i].flags = c->rx_bufs[i].flags; diff --git a/extras/libmemif/examples/icmp_responder/main.c b/extras/libmemif/examples/icmp_responder/main.c index f89f5796805..d70ecb5647e 100644 --- a/extras/libmemif/examples/icmp_responder/main.c +++ b/extras/libmemif/examples/icmp_responder/main.c @@ -126,7 +126,7 @@ main (int argc, char *argv[]) char socket_path[108]; int id = IF_ID; - strncpy (socket_path, SOCKET_PATH, strlen (SOCKET_PATH)); + strncpy (socket_path, SOCKET_PATH, sizeof (SOCKET_PATH)); /* prepare the private data */ memset (&intf, 0, sizeof (intf)); @@ -219,6 +219,8 @@ main (int argc, char *argv[]) */ if (intf.buffer_size) memif_conn_args.buffer_size = intf.buffer_size; + else + intf.buffer_size = 2048; memif_conn_args.socket = memif_socket; memif_conn_args.interface_id = id; diff --git a/extras/libmemif/examples/test_app/main.c b/extras/libmemif/examples/test_app/main.c index 763ec6c90e7..54c53921fe7 100644 --- a/extras/libmemif/examples/test_app/main.c +++ b/extras/libmemif/examples/test_app/main.c @@ -201,13 +201,13 @@ main (int argc, char *argv[]) int id0 = IF_ID0; int id1 = IF_ID1; - strncpy (socket_path, SOCKET_PATH, strlen (SOCKET_PATH)); + strncpy (socket_path, SOCKET_PATH, sizeof (SOCKET_PATH)); /* prepare the private data */ memset (&intf0, 0, sizeof (intf0)); memset (&intf1, 0, sizeof (intf1)); - while ((opt = getopt (argc, argv, "r:s:i:t:b:h:v")) != -1) + while ((opt = getopt (argc, argv, "r:s:i:t:b:hv")) != -1) { switch (opt) { |