discover: Null-terminate buffer in user_event_process()
authorSamuel Mendoza-Jonas <sam.mj@au1.ibm.com>
Wed, 11 Nov 2015 06:08:01 +0000 (17:08 +1100)
committerSamuel Mendoza-Jonas <sam.mj@au1.ibm.com>
Fri, 18 Dec 2015 00:15:58 +0000 (11:15 +1100)
Fixes Coverity defect #30480

Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>
discover/user-event.c

index 69defa34e341b22a9441b4b233f39d7b532eaa94..8cad1a91a624f5f55cd17d49858edfab3820133c 100644 (file)
@@ -488,10 +488,10 @@ static void user_event_handle_message(struct user_event *uev, char *buf,
 static int user_event_process(void *arg)
 {
        struct user_event *uev = arg;
-       char buf[PBOOT_USER_EVENT_SIZE];
+       char buf[PBOOT_USER_EVENT_SIZE + 1];
        int len;
 
-       len = recvfrom(uev->socket, buf, sizeof(buf), 0, NULL, NULL);
+       len = recvfrom(uev->socket, buf, PBOOT_USER_EVENT_SIZE, 0, NULL, NULL);
 
        if (len < 0) {
                pb_log("%s: socket read failed: %s", __func__, strerror(errno));
@@ -503,6 +503,8 @@ static int user_event_process(void *arg)
                return 0;
        }
 
+       buf[len] = '\0';
+
        pb_debug("%s: %u bytes\n", __func__, len);
 
        user_event_handle_message(uev, buf, len);