Yudi Yang 602d1b994a ntb_tool: Bound memory window option strings ...

parse_mw_buf() copies option names from privileged sysctl input into
eight-byte stack buffers.  Unbounded %s conversions permit option tokens
longer than seven bytes to write past those buffers before the parser
validates them.

Limit each conversion to seven characters, leaving space for the
terminating NUL.

Signed-off-by: Yudi Yang <[email protected]>

Fixes:		96f556f504 ("NTB Tool: Test driver for NTB hardware drivers.")
Reviewed by:	markj
MFC after:	1 week

2026-09-15 13:49:47 +00:00

..

if_ntb

…

ntb_hw

…

test

…

ntb_if.m

…

ntb_transport.c

…

ntb_transport.h

…

ntb.c

…

ntb.h

…