diff options
Diffstat (limited to 'xf86drm.c')
| -rw-r--r-- | xf86drm.c | 20 |
1 files changed, 18 insertions, 2 deletions
@@ -4471,14 +4471,24 @@ process_device(drmDevicePtr *device, const char *d_name, { struct stat sbuf; char node[PATH_MAX + 1]; - int node_type, subsystem_type; + int node_type, subsystem_type, written; unsigned int maj, min; + const int max_node_length = ALIGN(drmGetMaxNodeName(), sizeof(void *)); node_type = drmGetNodeType(d_name); if (node_type < 0) return -1; - snprintf(node, PATH_MAX, "%s/%s", DRM_DIR_NAME, d_name); + written = snprintf(node, PATH_MAX, "%s/%s", DRM_DIR_NAME, d_name); + if (written < 0) + return -1; + + /* anything longer than this will be truncated in drmDeviceAlloc. + * Account for NULL byte + */ + if (written + 1 > max_node_length) + return -1; + if (stat(node, &sbuf)) return -1; @@ -4585,6 +4595,7 @@ drm_public int drmGetDeviceFromDevId(dev_t find_rdev, uint32_t flags, drmDeviceP const char *dev_name; int node_type, subsystem_type; int maj, min, n, ret; + const int max_node_length = ALIGN(drmGetMaxNodeName(), sizeof(void *)); if (device == NULL) return -EINVAL; @@ -4603,9 +4614,14 @@ drm_public int drmGetDeviceFromDevId(dev_t find_rdev, uint32_t flags, drmDeviceP if (!dev_name) return -EINVAL; + /* anything longer than this will be truncated in drmDeviceAlloc. + * Account for NULL byte + */ n = snprintf(node, PATH_MAX, dev_name, DRM_DIR_NAME, min); if (n == -1 || n >= PATH_MAX) return -errno; + if (written + 1 > max_node_length) + return -EINVAL if (stat(node, &sbuf)) return -EINVAL; |