浏览代码

mtd: terminate user-provided string

Noticed by Coverity as a potential security issue.

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Brian Norris 11 年之前
父节点
当前提交
1cc8d84133
共有 1 个文件被更改,包括 3 次插入0 次删除
  1. 3 0
      drivers/mtd/mtdchar.c

+ 3 - 0
drivers/mtd/mtdchar.c

@@ -549,6 +549,9 @@ static int mtdchar_blkpg_ioctl(struct mtd_info *mtd,
 		if (mtd_is_partition(mtd))
 			return -EINVAL;
 
+		/* Sanitize user input */
+		p.devname[BLKPG_DEVNAMELTH - 1] = '\0';
+
 		return mtd_add_partition(mtd, p.devname, p.start, p.length);
 
 	case BLKPG_DEL_PARTITION: