svn commit: r273981 - stable/10/sys/cam/ctl

[Alexander Motin]

Author: mav
Date: Sun Nov  2 17:31:10 2014
New Revision: 273981
URL: https://svnweb.freebsd.org/changeset/base/273981

Log:
  MFC r273693: Fix printing non-terminated strings in devlist XML.

Modified:
  stable/10/sys/cam/ctl/ctl.c
  stable/10/sys/cam/ctl/ctl.h
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/cam/ctl/ctl.c
==============================================================================
--- stable/10/sys/cam/ctl/ctl.c	Sun Nov  2 17:30:30 2014	(r273980)
+++ stable/10/sys/cam/ctl/ctl.c	Sun Nov  2 17:31:10 2014	(r273981)
@@ -2202,13 +2202,14 @@ ctl_copyout_args(int num_args, struct ct
  * Escape characters that are illegal or not recommended in XML.
  */
 int
-ctl_sbuf_printf_esc(struct sbuf *sb, char *str)
+ctl_sbuf_printf_esc(struct sbuf *sb, char *str, int size)
 {
+	char *end = str + size;
 	int retval;
 
 	retval = 0;
 
-	for (; *str; str++) {
+	for (; *str && str < end; str++) {
 		switch (*str) {
 		case '&':
 			retval = sbuf_printf(sb, "&");
@@ -3200,7 +3201,8 @@ ctl_ioctl(struct cdev *dev, u_long cmd, 
 				break;
 
 			retval = ctl_sbuf_printf_esc(sb,
-						     lun->be_lun->serial_num);
+			    lun->be_lun->serial_num,
+			    sizeof(lun->be_lun->serial_num));
 
 			if (retval != 0)
 				break;
@@ -3215,7 +3217,9 @@ ctl_ioctl(struct cdev *dev, u_long cmd, 
 			if (retval != 0)
 				break;
 
-			retval = ctl_sbuf_printf_esc(sb,lun->be_lun->device_id);
+			retval = ctl_sbuf_printf_esc(sb,
+			    lun->be_lun->device_id,
+			    sizeof(lun->be_lun->device_id));
 
 			if (retval != 0)
 				break;

Modified: stable/10/sys/cam/ctl/ctl.h
==============================================================================
--- stable/10/sys/cam/ctl/ctl.h	Sun Nov  2 17:30:30 2014	(r273980)
+++ stable/10/sys/cam/ctl/ctl.h	Sun Nov  2 17:31:10 2014	(r273981)
@@ -156,7 +156,7 @@ int ctl_port_list(struct ctl_port_entry 
  * Put a string into an sbuf, escaping characters that are illegal or not
  * recommended in XML.  Note this doesn't escape everything, just > < and &.
  */
-int ctl_sbuf_printf_esc(struct sbuf *sb, char *str);
+int ctl_sbuf_printf_esc(struct sbuf *sb, char *str, int size);
 
 int ctl_ffz(uint32_t *mask, uint32_t size);
 int ctl_set_mask(uint32_t *mask, uint32_t bit);