Skip to content

Commit 98ac983

Browse files
committed
add missing \0 in case of strcpy() too long string
1 parent f633a0e commit 98ac983

File tree

2 files changed

+9
-1
lines changed

2 files changed

+9
-1
lines changed

src/pool/pool_disjoint.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,10 @@ static int CTL_READ_HANDLER(name)(void *ctx, umf_ctl_query_source_t source,
4545
return -1;
4646
}
4747

48-
strncpy((char *)arg, pool->params.name, size);
48+
if (size > 0) {
49+
strncpy((char *)arg, pool->params.name, size - 1);
50+
((char *)arg)[size - 1] = '\0';
51+
}
4952
return 0;
5053
}
5154

@@ -63,6 +66,7 @@ static int CTL_WRITE_HANDLER(name)(void *ctx, umf_ctl_query_source_t source,
6366
}
6467

6568
strncpy(pool->params.name, (char *)arg, sizeof(pool->params.name) - 1);
69+
pool->params.name[sizeof(pool->params.name) - 1] = '\0';
6670
return 0;
6771
}
6872

@@ -1083,6 +1087,7 @@ umfDisjointPoolParamsCreate(umf_disjoint_pool_params_handle_t *hParams) {
10831087
};
10841088

10851089
strncpy(params->name, DEFAULT_NAME, sizeof(params->name) - 1);
1090+
params->name[sizeof(params->name) - 1] = '\0';
10861091

10871092
*hParams = params;
10881093
return UMF_RESULT_SUCCESS;
@@ -1184,5 +1189,6 @@ umfDisjointPoolParamsSetName(umf_disjoint_pool_params_handle_t hParams,
11841189
}
11851190

11861191
strncpy(hParams->name, name, sizeof(hParams->name) - 1);
1192+
hParams->name[sizeof(hParams->name) - 1] = '\0';
11871193
return UMF_RESULT_SUCCESS;
11881194
}

src/provider/provider_cuda.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -529,9 +529,11 @@ static void cu_memory_provider_get_last_native_error(void *provider,
529529
if (result == CUDA_SUCCESS && error_name != NULL) {
530530
strncpy(TLS_last_native_error.msg_buff, error_name,
531531
TLS_MSG_BUF_LEN - 1);
532+
TLS_last_native_error.msg_buff[TLS_MSG_BUF_LEN - 1] = '\0';
532533
} else {
533534
strncpy(TLS_last_native_error.msg_buff, "cuGetErrorName() failed",
534535
TLS_MSG_BUF_LEN - 1);
536+
TLS_last_native_error.msg_buff[TLS_MSG_BUF_LEN - 1] = '\0';
535537
}
536538

537539
buf_size = strlen(TLS_last_native_error.msg_buff);

0 commit comments

Comments
 (0)