Skip to content

Commit

Permalink
Fix rpmsgfs/rpmsgfs_client.c:774:3: warning: 'strcpy' writing 1 or mo…
Browse files Browse the repository at this point in the history
…re bytes into a region of size 0 overflows the destination

Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
  • Loading branch information
xiaoxiang781216 authored and pkarashchenko committed Mar 23, 2022
1 parent 0fcb457 commit 4d8c926
Showing 1 changed file with 6 additions and 5 deletions.
11 changes: 6 additions & 5 deletions fs/rpmsgfs/rpmsgfs_client.c
Original file line number Diff line number Diff line change
Expand Up @@ -726,11 +726,12 @@ int rpmsgfs_client_rename(FAR void *handle, FAR const char *oldpath,
struct rpmsgfs_rename_s *msg;
size_t len;
size_t oldlen;
size_t newlen;
uint32_t space;

len = sizeof(*msg);
oldlen = (strlen(oldpath) + 1 + 0x7) & ~0x7;
len += oldlen + strlen(newpath) + 1;
oldlen = strlen(oldpath) + 1;
newlen = strlen(newpath) + 1;
len = sizeof(*msg) + oldlen + newlen;

msg = rpmsg_get_tx_payload_buffer(&priv->ept, &space, true);
if (!msg)
Expand All @@ -740,8 +741,8 @@ int rpmsgfs_client_rename(FAR void *handle, FAR const char *oldpath,

DEBUGASSERT(len <= space);

strcpy(msg->pathname, oldpath);
strcpy(msg->pathname + oldlen, newpath);
memcpy(msg->pathname, oldpath, oldlen);
memcpy(msg->pathname + oldlen, newpath, newlen);

return rpmsgfs_send_recv(priv, RPMSGFS_RENAME, false,
(struct rpmsgfs_header_s *)msg, len, NULL);
Expand Down

0 comments on commit 4d8c926

Please sign in to comment.