commit d7c96324c0fc7e23cd901c6166f1a7dba3e5b896
author Tianyu Li <tianyu.li@arm.com> Wed Jul 12 05:51:42 2023 +0000
committer Dave Wallace <dwallacelf@gmail.com> Fri Jan 12 03:22:56 2024 +0000
tree 99d66d97e6f91078fb653a2d8f8a810191e4e8d3
parent 00e9fe6ca771bfbe7ee62e80a44903ffb227cae2

libmemif: fix segfault and buffer overflow in examples

- Fix buffer overflow caused by strncpy(dst, src, strlen(src)),
use sized buffer to ensure overflow safe.

- Fix test_app getopt usage

 When use example/icmp_responder in slave mode
- Fix segfault when buffer size is not specified
- Fix wrong packet send out.

Type: fix
Signed-off-by: Tianyu Li <tianyu.li@arm.com>
Change-Id: I5ed47fd8e630420d7ae0203a2605d2b9abd33d2a

extras/libmemif/examples/icmp_responder/main.c

diff --git a/extras/libmemif/examples/icmp_responder/main.c b/extras/libmemif/examples/icmp_responder/main.c
index f89f579..d70ecb5 100644
--- a/extras/libmemif/examples/icmp_responder/main.c
+++ b/extras/libmemif/examples/icmp_responder/main.c
@@ -126,7 +126,7 @@
   char socket_path[108];
   int id = IF_ID;
 
-  strncpy (socket_path, SOCKET_PATH, strlen (SOCKET_PATH));
+  strncpy (socket_path, SOCKET_PATH, sizeof (SOCKET_PATH));
 
   /* prepare the private data */
   memset (&intf, 0, sizeof (intf));
@@ -219,6 +219,8 @@
    */
   if (intf.buffer_size)
     memif_conn_args.buffer_size = intf.buffer_size;
+  else
+    intf.buffer_size = 2048;
 
   memif_conn_args.socket = memif_socket;
   memif_conn_args.interface_id = id;