libmemif: fix segfault and buffer overflow in examples
- Fix buffer overflow caused by strncpy(dst, src, strlen(src)), use sized buffer to ensure overflow safe. - Fix test_app getopt usage When use example/icmp_responder in slave mode - Fix segfault when buffer size is not specified - Fix wrong packet send out. Type: fix Signed-off-by: Tianyu Li <tianyu.li@arm.com> Change-Id: I5ed47fd8e630420d7ae0203a2605d2b9abd33d2a
This commit is contained in:
@ -48,7 +48,7 @@ icmp_packet_handler (memif_connection_t *c)
|
||||
for (i = 0; i < c->tx_buf_num; i++)
|
||||
{
|
||||
uint32_t len;
|
||||
void *packet = c->rx_bufs[i].data;
|
||||
void *packet = c->tx_bufs[i].data;
|
||||
|
||||
memcpy (c->tx_bufs[i].data, c->rx_bufs[i].data, c->rx_bufs[i].len);
|
||||
c->tx_bufs[i].flags = c->rx_bufs[i].flags;
|
||||
|
@ -126,7 +126,7 @@ main (int argc, char *argv[])
|
||||
char socket_path[108];
|
||||
int id = IF_ID;
|
||||
|
||||
strncpy (socket_path, SOCKET_PATH, strlen (SOCKET_PATH));
|
||||
strncpy (socket_path, SOCKET_PATH, sizeof (SOCKET_PATH));
|
||||
|
||||
/* prepare the private data */
|
||||
memset (&intf, 0, sizeof (intf));
|
||||
@ -219,6 +219,8 @@ main (int argc, char *argv[])
|
||||
*/
|
||||
if (intf.buffer_size)
|
||||
memif_conn_args.buffer_size = intf.buffer_size;
|
||||
else
|
||||
intf.buffer_size = 2048;
|
||||
|
||||
memif_conn_args.socket = memif_socket;
|
||||
memif_conn_args.interface_id = id;
|
||||
|
@ -201,13 +201,13 @@ main (int argc, char *argv[])
|
||||
int id0 = IF_ID0;
|
||||
int id1 = IF_ID1;
|
||||
|
||||
strncpy (socket_path, SOCKET_PATH, strlen (SOCKET_PATH));
|
||||
strncpy (socket_path, SOCKET_PATH, sizeof (SOCKET_PATH));
|
||||
|
||||
/* prepare the private data */
|
||||
memset (&intf0, 0, sizeof (intf0));
|
||||
memset (&intf1, 0, sizeof (intf1));
|
||||
|
||||
while ((opt = getopt (argc, argv, "r:s:i:t:b:h:v")) != -1)
|
||||
while ((opt = getopt (argc, argv, "r:s:i:t:b:hv")) != -1)
|
||||
{
|
||||
switch (opt)
|
||||
{
|
||||
|
Reference in New Issue
Block a user