static analysis reports "Buffer not null terminated" issues in stx-nfv

Bug #1794704 reported by Ran An
278
This bug affects 2 people
Affects Status Importance Assigned to Milestone
StarlingX
Fix Released
High
Ran An

Bug Description

Brief Description
-----------------
  in some files, it use 'sncpy()' function which can not guarantee null termination of the string. This will lead a further security issue: "If the buffer is treated as a null terminated string in later operations, a buffer overflow or over-read may occur."

Severity
--------
 Major

Steps to Reproduce
------------------
  use function 'snprintf()' instead of 'sncpy()'

Expected Behavior
------------------
  static analysis do not report this issue

Actual Behavior
----------------
  static analysis report this issue

Reproducibility
---------------
Reproducible

System Configuration
--------------------
all

Static Analysis Reports
--------------------
Buffer not null terminated
If the buffer is treated as a null terminated string in later operations, a buffer overflow or over-read may occur.

host_instance_mgmt.c:266
  buffer_size_warning: Calling strncpy with a maximum size argument of 20 bytes on destination array instance->name of size 20 bytes might leave the destination string unterminated

similar cases at host_instance_mgmt.c:403, host_instance_mgmt.c:462

Ran An (an.ran)
Changed in starlingx:
assignee: nobody → Ran An (an.ran)
Ran An (an.ran)
tags: added: stx.security
Ken Young (kenyis)
Changed in starlingx:
status: New → Triaged
importance: Undecided → High
Revision history for this message
Bruce Jones (brucej) wrote :

Please update this bug with specific file and line number information for the static analysis issue. Make sure the bug has enough information for someone to find the problem in the code without access to the tool or the report.

Ran An (an.ran)
description: updated
description: updated
Ken Young (kenyis)
tags: added: stx.2019.03
Revision history for this message
Ran An (an.ran) wrote :
Ran An (an.ran)
Changed in starlingx:
status: Triaged → Fix Released
Ken Young (kenyis)
information type: Private Security → Public Security
Ken Young (kenyis)
tags: added: stx.2019.05
removed: stx.2019.03
Ken Young (kenyis)
tags: added: stx.2.0
removed: stx.2019.05
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.