Skip to content

Commit 9cc3fdc

Browse files
One Thousand GnomesKalle Valo
authored andcommitted
rt2x00: unterminated strlen of user data
The buffer needs to be zero terminated in case the user data is not. Otherwise we run off the end of the buffer. Signed-off-by: Alan Cox <[email protected]> Reviewed-by: Julian Calaby <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
1 parent 7b5acd1 commit 9cc3fdc

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

drivers/net/wireless/ralink/rt2x00/rt2x00debug.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -478,7 +478,7 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \
478478
{ \
479479
struct rt2x00debug_intf *intf = file->private_data; \
480480
const struct rt2x00debug *debug = intf->debug; \
481-
char line[16]; \
481+
char line[17]; \
482482
size_t size; \
483483
unsigned int index = intf->offset_##__name; \
484484
__type value; \
@@ -494,7 +494,8 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \
494494
\
495495
if (copy_from_user(line, buf, length)) \
496496
return -EFAULT; \
497-
\
497+
line[16] = 0; \
498+
\
498499
size = strlen(line); \
499500
value = simple_strtoul(line, NULL, 0); \
500501
\

0 commit comments

Comments
 (0)