浏览代码

Input: cyapa - off by one in cyapa_update_fw_store()

If "(count == NAME_MAX)" then we could end up putting the NUL terminator
one space beyond the end of the fw_name[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Dan Carpenter 10 年之前
父节点
当前提交
b481077375
共有 1 个文件被更改,包括 1 次插入1 次删除
  1. 1 1
      drivers/input/mouse/cyapa.c

+ 1 - 1
drivers/input/mouse/cyapa.c

@@ -1013,7 +1013,7 @@ static ssize_t cyapa_update_fw_store(struct device *dev,
 	char fw_name[NAME_MAX];
 	int ret, error;
 
-	if (count > NAME_MAX) {
+	if (count >= NAME_MAX) {
 		dev_err(dev, "File name too long\n");
 		return -EINVAL;
 	}