Commit 3067bbd1 authored by Dan Carpenter's avatar Dan Carpenter Committed by Helge Deller

parisc: sys_hpux: NUL terminator is one past the end

We allocate "len" number of chars so we should put the NUL at "len - 1"
to avoid corrupting memory.  Btw, strlen_user() is different from the
normal strlen() function because it includes NUL terminator in the
count.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
parent 68e37028
...@@ -456,7 +456,7 @@ int hpux_sysfs(int opcode, unsigned long arg1, unsigned long arg2) ...@@ -456,7 +456,7 @@ int hpux_sysfs(int opcode, unsigned long arg1, unsigned long arg2)
} }
/* String could be altered by userspace after strlen_user() */ /* String could be altered by userspace after strlen_user() */
fsname[len] = '\0'; fsname[len - 1] = '\0';
printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname); printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname);
if ( !strcmp(fsname, "hfs") ) { if ( !strcmp(fsname, "hfs") ) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment