diff options
| author | One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> | 2016-02-15 22:04:56 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2016-03-07 15:00:25 +0300 |
| commit | 9cc3fdc86c6006bae878da6d2d14c1633064a12f (patch) | |
| tree | 83130fdb8a3c609f1a74d295e867f420177bba03 | |
| parent | 7b5acd11a3ffec027abf4df2b30690a974873174 (diff) | |
| download | linux-9cc3fdc86c6006bae878da6d2d14c1633064a12f.tar.xz | |
rt2x00: unterminated strlen of user data
The buffer needs to be zero terminated in case the user data is not.
Otherwise we run off the end of the buffer.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
| -rw-r--r-- | drivers/net/wireless/ralink/rt2x00/rt2x00debug.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c index 25ee3cb8e982..72ae530e4a3b 100644 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c @@ -478,7 +478,7 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \ { \ struct rt2x00debug_intf *intf = file->private_data; \ const struct rt2x00debug *debug = intf->debug; \ - char line[16]; \ + char line[17]; \ size_t size; \ unsigned int index = intf->offset_##__name; \ __type value; \ @@ -494,7 +494,8 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \ \ if (copy_from_user(line, buf, length)) \ return -EFAULT; \ - \ + line[16] = 0; \ + \ size = strlen(line); \ value = simple_strtoul(line, NULL, 0); \ \ |