Commit 2f5c638c authored by Christopher Harvey's avatar Christopher Harvey Committed by Greg Kroah-Hartman

staging: usbip: fix potential segfault because of unchecked return value of strchr.

This doesn't happen with the usbip virtual hci module, but another
module wanting to interface with this user space code could cause a
seg-fault by sending data without newlines.
Signed-off-by: default avatarChristopher Harvey <charvey@matrox.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 310c6a76
...@@ -59,7 +59,10 @@ static int parse_status(char *value) ...@@ -59,7 +59,10 @@ static int parse_status(char *value)
/* skip a header line */ /* skip a header line */
c = strchr(value, '\n') + 1; c = strchr(value, '\n');
if (!c)
return -1;
c++;
while (*c != '\0') { while (*c != '\0') {
int port, status, speed, devid; int port, status, speed, devid;
...@@ -109,7 +112,10 @@ static int parse_status(char *value) ...@@ -109,7 +112,10 @@ static int parse_status(char *value)
/* go to the next line */ /* go to the next line */
c = strchr(c, '\n') + 1; c = strchr(c, '\n');
if (!c)
break;
c++;
} }
dbg("exit"); dbg("exit");
...@@ -264,11 +270,17 @@ static int get_nports(void) ...@@ -264,11 +270,17 @@ static int get_nports(void)
attr_status->method, attr_status->value); attr_status->method, attr_status->value);
/* skip a header line */ /* skip a header line */
c = strchr(attr_status->value, '\n') + 1; c = strchr(attr_status->value, '\n');
if (!c)
return 0;
c++;
while (*c != '\0') { while (*c != '\0') {
/* go to the next line */ /* go to the next line */
c = strchr(c, '\n') + 1; c = strchr(c, '\n');
if (!c)
return nports;
c++;
nports += 1; nports += 1;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment