leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rt2x00: unterminated strlen of user data

Browse Source 
The buffer needs to be zero terminated in case the user data is not.
Otherwise we run off the end of the buffer.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
This commit is contained in:
One Thousand Gnomes 2016-02-15 19:04:56 +00:00 committed by Kalle Valo
parent 7b5acd11a3
commit 9cc3fdc86c
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
View File

@ -478,7 +478,7 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \
{ \
struct rt2x00debug_intf *intf = file->private_data; \
const struct rt2x00debug *debug = intf->debug; \
char line[16]; \
char line[17]; \
size_t size; \
unsigned int index = intf->offset_##__name; \
__type value; \
@ -494,7 +494,8 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \
\
if (copy_from_user(line, buf, length)) \
return -EFAULT; \
\
line[16] = 0; \
\
size = strlen(line); \
value = simple_strtoul(line, NULL, 0); \
\