commit 4ecd1ef010beadef05f7c63c4546849b2eb5ac15
author Taro Yamada <archer_ame@yahoo.co.jp> Tue Dec 13 20:18:28 2016 +0900
committer Emil Velikov <emil.l.velikov@gmail.com> Mon Jan 16 14:41:36 2017 +0000
tree e4df52d4af35c3bf26fdc9620d600b2fa1412ed0
parent 44f220ad6200dbccebea2287b874fda7665efe4d

xf86drm: fix null termination of string buffer

The string written to the buffer by read() is not null-terminated,
but currently drmParsePciBusInfo() places null character only at the end of the buffer, not at the end of the
string.
As a result, the string passed to sscanf() contains an uninitialized value.

This patch changes to places null character at the end of the string.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99045
Signed-off-by: Taro Yamada <archer_ame@yahoo.co.jp>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>

configure.ac

diff --git a/configure.ac b/configure.ac
index e0597c3..39973b6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -61,7 +61,7 @@
 LT_INIT([disable-static])
 
 
-PKG_CHECK_MODULES(PTHREADSTUBS, pthread-stubs)
+
 AC_SUBST(PTHREADSTUBS_CFLAGS)
 AC_SUBST(PTHREADSTUBS_LIBS)
 

xf86drm.c

diff --git a/xf86drm.c b/xf86drm.c
index b8b2cfe..7b78dc6 100644
--- a/xf86drm.c
+++ b/xf86drm.c
@@ -2929,11 +2929,11 @@
     if (fd < 0)
         return -errno;
 
-    ret = read(fd, data, sizeof(data));
-    data[sizeof(data)-1] = '\0';
+    ret = read(fd, data, sizeof(data)-1);
     close(fd);
     if (ret < 0)
         return -errno;
+    data[ret] = '\0';
 
 #define TAG "PCI_SLOT_NAME="
     str = strstr(data, TAG);