UCT/IB: Fix buffer overflow with strncat().

alinask · Jun 29, 2017 · 7fd9e4d · 7fd9e4d
1 parent 71dfa34
commit 7fd9e4d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/uct/ib/base/ib_md.c b/src/uct/ib/base/ib_md.c
@@ -958,7 +958,7 @@ static ucs_rcache_ops_t uct_ib_rcache_ops = {
 static void uct_ib_make_md_name(char md_name[UCT_MD_NAME_MAX], struct ibv_device *device)
 {
     snprintf(md_name, UCT_MD_NAME_MAX, "%s/", UCT_IB_MD_PREFIX);
-    strncat(md_name, device->name, UCT_MD_NAME_MAX);
+    strncat(md_name, device->name, UCT_MD_NAME_MAX - strlen(device->name) - 1);
 }
 
 static ucs_status_t uct_ib_query_md_resources(uct_md_resource_desc_t **resources_p,