bios_emulator: Fix buffer overflow

Using strcpy to copy a 4 character string into a 4 byte field in a
structure will overflow that field as it writes the terminating \0 into
the following field. Correct this by using memcpy instead.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>

diff --git a/drivers/bios_emulator/atibios.c b/drivers/bios_emulator/atibios.c
index d544ffb5ffb6483c16fb33681350477f81b85cf1..e992a1aa822c9b46c3c139547b79c52392edd48f 100644 (file)
--- a/drivers/bios_emulator/atibios.c
+++ b/drivers/bios_emulator/atibios.c
@@ -99,7 +99,7 @@ static int atibios_debug_mode(BE_VGAInfo *vga_info, RMREGS *regs,
        regs->e.edi = buffer_adr;
        info = buffer;
        memset(info, '\0', sizeof(*info));
-       strcpy(info->signature, "VBE2");
+       memcpy(info->signature, "VBE2", 4);
        BE_int86(0x10, regs, regs);
        if (regs->e.eax != 0x4f) {
                debug("VESA_GET_INFO: error %x\n", regs->e.eax);