Commit 0f6e8aab authored by Chen Gang's avatar Chen Gang Committed by Greg Kroah-Hartman

staging: for dgrp, let nd_ps_desc always NUL terminated string within MAX_DESC_LEN length

Use strlcpy instead of strncpy to let nd_ps_desc always NUL terminated.

Change nd_ps_desc in nd_struct struct to MAX_DESC_LEN to avoid the
confusion (the related length checking also need be changed to
MAX_DESC_LEN - 1).
Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
Acked-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 205179d0
...@@ -392,7 +392,7 @@ static long dgrp_dpa_ioctl(struct file *file, unsigned int cmd, ...@@ -392,7 +392,7 @@ static long dgrp_dpa_ioctl(struct file *file, unsigned int cmd,
getnode.nd_rx_byte = nd->nd_rx_byte; getnode.nd_rx_byte = nd->nd_rx_byte;
memset(&getnode.nd_ps_desc, 0, MAX_DESC_LEN); memset(&getnode.nd_ps_desc, 0, MAX_DESC_LEN);
strncpy(getnode.nd_ps_desc, nd->nd_ps_desc, MAX_DESC_LEN); strlcpy(getnode.nd_ps_desc, nd->nd_ps_desc, MAX_DESC_LEN);
if (copy_to_user(uarg, &getnode, sizeof(struct digi_node))) if (copy_to_user(uarg, &getnode, sizeof(struct digi_node)))
return -EFAULT; return -EFAULT;
......
...@@ -3083,7 +3083,7 @@ static void dgrp_receive(struct nd_struct *nd) ...@@ -3083,7 +3083,7 @@ static void dgrp_receive(struct nd_struct *nd)
nd->nd_hw_ver = (b[8] << 8) | b[9]; nd->nd_hw_ver = (b[8] << 8) | b[9];
nd->nd_sw_ver = (b[10] << 8) | b[11]; nd->nd_sw_ver = (b[10] << 8) | b[11];
nd->nd_hw_id = b[6]; nd->nd_hw_id = b[6];
desclen = ((plen - 12) > MAX_DESC_LEN) ? MAX_DESC_LEN : desclen = (plen - 12 > MAX_DESC_LEN - 1) ? MAX_DESC_LEN - 1 :
plen - 12; plen - 12;
if (desclen <= 0) { if (desclen <= 0) {
......
...@@ -674,7 +674,7 @@ struct nd_struct { ...@@ -674,7 +674,7 @@ struct nd_struct {
ushort nd_hw_ver; /* HW version returned from PS */ ushort nd_hw_ver; /* HW version returned from PS */
ushort nd_sw_ver; /* SW version returned from PS */ ushort nd_sw_ver; /* SW version returned from PS */
uint nd_hw_id; /* HW ID returned from PS */ uint nd_hw_id; /* HW ID returned from PS */
u8 nd_ps_desc[MAX_DESC_LEN+1]; /* Description from PS */ u8 nd_ps_desc[MAX_DESC_LEN]; /* Description from PS */
uint nd_vpd_len; /* VPD len, if any */ uint nd_vpd_len; /* VPD len, if any */
u8 nd_vpd[VPDSIZE]; /* VPD, if any */ u8 nd_vpd[VPDSIZE]; /* VPD, if any */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment