leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

arch: s390: appldata: using strncpy() and strnlen() instead of sprintf()

Browse Source 
'buf[2]' is 2 bytes length, and sprintf() will append '\0' at the end
of string "?\n", so original implementation is memory overflow.

Need use strncpy() and strnlen() instead of sprintf().

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
Chen Gang 2013-05-27 17:55:13 +08:00 committed by Martin Schwidefsky
parent 9acf73b7d0
commit d5b4c2f493
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
arch/s390/appldata/appldata_base.c
View File

@ -212,7 +212,9 @@ appldata_timer_handler(ctl_table *ctl, int write,
return 0;
}
if (!write) {
len = sprintf(buf, appldata_timer_active ? "1\n" : "0\n");
strncpy(buf, appldata_timer_active ? "1\n" : "0\n",
ARRAY_SIZE(buf));
len = strnlen(buf, ARRAY_SIZE(buf));
if (len > *lenp)
len = *lenp;
if (copy_to_user(buffer, buf, len))
@ -317,7 +319,8 @@ appldata_generic_handler(ctl_table *ctl, int write,
return 0;
}
if (!write) {
len = sprintf(buf, ops->active ? "1\n" : "0\n");
strncpy(buf, ops->active ? "1\n" : "0\n", ARRAY_SIZE(buf));
len = strnlen(buf, ARRAY_SIZE(buf));
if (len > *lenp)
len = *lenp;
if (copy_to_user(buffer, buf, len)) {