File 0001-fix-a-buffer-overflow.patch of Package mdadm.3522
commit df5b0515a823bb9aceb65d84a1f56008e0c0f03f
Author: Zhilong Liu <zlliu@suse.com>
Date: Mon Nov 7 22:24:51 2016 -0500
mdadm: fix a buffer overflow
super1:struct mdp_superblock_1.set_name is 32B long,
but struct mdinfo.name is 33B long. So we need strncpy
instead strcpy to avoid buffer overflow.
Signed-off-by: Zhilong Liu <zlliu@suse.com>
diff --git a/super1.c b/super1.c
index 8bcaa2f..52c404f 100644
--- a/super1.c
+++ b/super1.c
@@ -1300,7 +1300,7 @@ static int update_super1(struct supertype *st, struct mdinfo *info,
strcat(sb->set_name, ":");
strcat(sb->set_name, info->name);
} else
- strcpy(sb->set_name, info->name);
+ strncpy(sb->set_name, info->name, sizeof(sb->set_name));
} else if (strcmp(update, "devicesize") == 0 &&
__le64_to_cpu(sb->super_offset) <
__le64_to_cpu(sb->data_offset)) {
@@ -1457,7 +1457,7 @@ static int init_super1(struct supertype *st, mdu_array_info_t *info,
strcat(sb->set_name, ":");
strcat(sb->set_name, name);
} else
- strcpy(sb->set_name, name);
+ strncpy(sb->set_name, name, sizeof(sb->set_name));
sb->ctime = __cpu_to_le64((unsigned long long)time(0));
sb->level = __cpu_to_le32(info->level);