Commit d15ad69b authored by Petri Latvala's avatar Petri Latvala

lib/igt_pm: Avoid out-of-bounds reads and writes

Read sizeof - 1 to buffers so null-termination stays in bounds.

v2: Also clear the buffers before reusing (Chris).
Signed-off-by: Petri Latvala's avatarPetri Latvala <petri.latvala@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Chris Wilson's avatarChris Wilson <chris@chris-wilson.co.uk>
parent f8294a8c
Pipeline #22982 passed with stages
in 11 minutes and 55 seconds
......@@ -101,7 +101,12 @@ static int __igt_pm_audio_restore_runtime_pm(void)
close(fd);
__igt_pm_audio_runtime_power_save[0] = 0;
memset(__igt_pm_audio_runtime_power_save, 0,
sizeof(__igt_pm_audio_runtime_power_save));
memset(__igt_pm_audio_runtime_control, 0,
sizeof(__igt_pm_audio_runtime_control));
free(__igt_pm_audio_runtime_control_path);
__igt_pm_audio_runtime_control_path = NULL;
......@@ -176,9 +181,10 @@ static int __igt_pm_enable_audio_runtime_pm(void)
if (fd < 0)
continue;
ret = read(fd, buf, sizeof(buf));
ret = read(fd, buf, sizeof(buf) - 1);
close(fd);
igt_assert(ret > 0);
buf[ret] = '\0';
strchomp(buf);
/* Realtek and similar devices are not what we are after. */
......@@ -206,7 +212,7 @@ static int __igt_pm_enable_audio_runtime_pm(void)
}
igt_assert(read(fd, __igt_pm_audio_runtime_power_save,
sizeof(__igt_pm_audio_runtime_power_save)) > 0);
sizeof(__igt_pm_audio_runtime_power_save) - 1) > 0);
strchomp(__igt_pm_audio_runtime_power_save);
igt_install_exit_handler(__igt_pm_audio_runtime_exit_handler);
igt_assert_eq(write(fd, "1\n", 2), 2);
......@@ -219,7 +225,7 @@ static int __igt_pm_enable_audio_runtime_pm(void)
}
igt_assert(read(fd, __igt_pm_audio_runtime_control,
sizeof(__igt_pm_audio_runtime_control)) > 0);
sizeof(__igt_pm_audio_runtime_control) - 1) > 0);
strchomp(__igt_pm_audio_runtime_control);
igt_assert_eq(write(fd, "auto\n", 5), 5);
close(fd);
......@@ -527,7 +533,7 @@ bool igt_setup_runtime_pm(void)
* them on test exit.
*/
size = read(fd, __igt_pm_runtime_autosuspend,
sizeof(__igt_pm_runtime_autosuspend));
sizeof(__igt_pm_runtime_autosuspend) - 1);
/*
* If we fail to read from the file, it means this system doesn't
......@@ -539,6 +545,8 @@ bool igt_setup_runtime_pm(void)
return false;
}
__igt_pm_runtime_autosuspend[size] = '\0';
strchomp(__igt_pm_runtime_autosuspend);
igt_install_exit_handler(__igt_pm_runtime_exit_handler);
......@@ -554,7 +562,7 @@ bool igt_setup_runtime_pm(void)
igt_assert_f(fd >= 0, "Can't open " POWER_DIR "/control\n");
igt_assert(read(fd, __igt_pm_runtime_control,
sizeof(__igt_pm_runtime_control)) > 0);
sizeof(__igt_pm_runtime_control) - 1) > 0);
strchomp(__igt_pm_runtime_control);
igt_debug("Saved runtime power management as '%s' and '%s'\n",
......@@ -588,7 +596,7 @@ enum igt_runtime_pm_status igt_get_runtime_pm_status(void)
char buf[32];
lseek(pm_status_fd, 0, SEEK_SET);
n_read = read(pm_status_fd, buf, ARRAY_SIZE(buf));
n_read = read(pm_status_fd, buf, ARRAY_SIZE(buf) - 1);
igt_assert(n_read >= 0);
buf[n_read] = '\0';
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment