strlen() requires eng_type[8] to be NUL-terminated, but strcpy() does
not check the buffer size or guarantee NUL termination. This may lead
to out-of-bounds memory access when accessing eng_type[i].
Replace strcpy() with strscpy() to ensure NUL termination and prevent
potential overflow. This improves code safety and robustness.
Link: https://github.com/KSPP/linux/issues/88
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
---
drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
index ebdf4efa09d4..2371696df426 100644
--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
@@ -458,13 +458,13 @@ static int cpt_ucode_load_fw(struct pci_dev *pdev, struct fw_info_t *fw_info,
u16 rid)
{
char filename[OTX2_CPT_NAME_LENGTH];
- char eng_type[8] = {0};
+ char eng_type[8];
int ret, e, i;
INIT_LIST_HEAD(&fw_info->ucodes);
for (e = 1; e < OTX2_CPT_MAX_ENG_TYPES; e++) {
- strcpy(eng_type, get_eng_type_str(e));
+ strscpy(eng_type, get_eng_type_str(e));
for (i = 0; i < strlen(eng_type); i++)
eng_type[i] = tolower(eng_type[i]);
--
2.25.1