summaryrefslogtreecommitdiff
path: root/sys/dev/pv
diff options
context:
space:
mode:
authorMike Belopuhov <mikeb@cvs.openbsd.org>2017-08-10 17:11:50 +0000
committerMike Belopuhov <mikeb@cvs.openbsd.org>2017-08-10 17:11:50 +0000
commit203759fd42e6e752fc6d9e9e74d271994d5a7774 (patch)
tree184fd9500845d28b6e0f3bd9894d2231f5de7a19 /sys/dev/pv
parentbefd35f079c9499f9153b7f71f74d56bdb8a1ae6 (diff)
Buffer size for the SCSI vendor string should be 8 char long
A vendor and part of the product string got copied into a larger on-stack buffer as a result of an out-of-bounds access, however only 4 characters are meaningful in this context. Coverity CID 1453206; Severity: insignificant.
Diffstat (limited to 'sys/dev/pv')
-rw-r--r--sys/dev/pv/hvs.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/dev/pv/hvs.c b/sys/dev/pv/hvs.c
index 0666c432119..566698a1a92 100644
--- a/sys/dev/pv/hvs.c
+++ b/sys/dev/pv/hvs.c
@@ -589,7 +589,7 @@ fixup_inquiry(struct scsi_xfer *xs, struct hvs_srb *srb)
struct hvs_softc *sc = xs->sc_link->adapter_softc;
struct scsi_inquiry_data *inq = (struct scsi_inquiry_data *)xs->data;
int datalen, resplen;
- char vendor[16];
+ char vendor[8];
resplen = srb->srb_datalen >= 5 ? inq->additional_length + 5 : 0;
datalen = MIN(resplen, srb->srb_datalen);