scsi_id: prevent buffer overflow in check_fill_0x83_prespc3()

[elogind.git] / extras / scsi_id / scsi_serial.c

diff --git a/extras/scsi_id/scsi_serial.c b/extras/scsi_id/scsi_serial.c
index 2e9168f9419de2b3c53e880142c4d907d4c5f37d..ab0ffd62aaa963c28dd542a3ee0e3b81d22f4f51 100644 (file)
--- a/extras/scsi_id/scsi_serial.c
+++ b/extras/scsi_id/scsi_serial.c
@@ -28,8 +28,7 @@
 #include <scsi/scsi.h>
 #include <scsi/sg.h>
 #include <linux/types.h>
-/* #include <linux/bsg.h> */
-#include "bsg.h"
+#include <linux/bsg.h>
 
 #include "libudev.h"
 #include "libudev-private.h"
@@ -170,7 +169,6 @@ static int scsi_dump_sense(struct udev *udev,
        int code;
        int sense_class;
        int sense_key;
-       int descriptor_format;
        int asc, ascq;
 #ifdef DUMP_SENSE
        char out_buffer[256];
@@ -210,7 +208,6 @@ static int scsi_dump_sense(struct udev *udev,
                        return -1;
                }
                if ((code == 0x0) || (code == 0x1)) {
-                       descriptor_format = 0;
                        sense_key = sense_buffer[2] & 0xf;
                        if (s < 14) {
                                /*
@@ -223,7 +220,6 @@ static int scsi_dump_sense(struct udev *udev,
                        asc = sense_buffer[12];
                        ascq = sense_buffer[13];
                } else if ((code == 0x2) || (code == 0x3)) {
-                       descriptor_format = 1;
                        sense_key = sense_buffer[1] & 0xf;
                        asc = sense_buffer[2];
                        ascq = sense_buffer[3];
@@ -582,11 +578,12 @@ static int check_fill_0x83_prespc3(struct udev *udev,
        /* serial has been memset to zero before */
        j = strlen(serial);     /* j = 1; */
 
-       for (i = 0; i < page_83[3]; ++i) {
+       for (i = 0; (i < page_83[3]) && (j < max_len-3); ++i) {
                serial[j++] = hex_str[(page_83[4+i] & 0xf0) >> 4];
                serial[j++] = hex_str[ page_83[4+i] & 0x0f];
        }
-       strcpy(serial_short, serial);
+       serial[max_len-1] = 0;
+       strncpy(serial_short, serial, max_len-1);
        return 0;
 }