rt2x00: unterminated strlen of user data
The buffer needs to be zero terminated in case the user data is not. Otherwise we run off the end of the buffer. Signed-off-by: Alan Cox <alan@linux.intel.com> Reviewed-by: Julian Calaby <julian.calaby@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
This commit is contained in:
Родитель
7b5acd11a3
Коммит
9cc3fdc86c
|
@ -478,7 +478,7 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \
|
||||||
{ \
|
{ \
|
||||||
struct rt2x00debug_intf *intf = file->private_data; \
|
struct rt2x00debug_intf *intf = file->private_data; \
|
||||||
const struct rt2x00debug *debug = intf->debug; \
|
const struct rt2x00debug *debug = intf->debug; \
|
||||||
char line[16]; \
|
char line[17]; \
|
||||||
size_t size; \
|
size_t size; \
|
||||||
unsigned int index = intf->offset_##__name; \
|
unsigned int index = intf->offset_##__name; \
|
||||||
__type value; \
|
__type value; \
|
||||||
|
@ -494,6 +494,7 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \
|
||||||
\
|
\
|
||||||
if (copy_from_user(line, buf, length)) \
|
if (copy_from_user(line, buf, length)) \
|
||||||
return -EFAULT; \
|
return -EFAULT; \
|
||||||
|
line[16] = 0; \
|
||||||
\
|
\
|
||||||
size = strlen(line); \
|
size = strlen(line); \
|
||||||
value = simple_strtoul(line, NULL, 0); \
|
value = simple_strtoul(line, NULL, 0); \
|
||||||
|
|
Загрузка…
Ссылка в новой задаче