Commit c735483d authored by Helge Deller's avatar Helge Deller

parisc: pdc_stable.c: Avoid potential stack overflows

Signed-off-by: default avatarHelge Deller <deller@gmx.de>
parent 94c457de
...@@ -278,7 +278,7 @@ pdcspath_hwpath_write(struct pdcspath_entry *entry, const char *buf, size_t coun ...@@ -278,7 +278,7 @@ pdcspath_hwpath_write(struct pdcspath_entry *entry, const char *buf, size_t coun
{ {
struct hardware_path hwpath; struct hardware_path hwpath;
unsigned short i; unsigned short i;
char in[count+1], *temp; char in[64], *temp;
struct device *dev; struct device *dev;
int ret; int ret;
...@@ -286,8 +286,9 @@ pdcspath_hwpath_write(struct pdcspath_entry *entry, const char *buf, size_t coun ...@@ -286,8 +286,9 @@ pdcspath_hwpath_write(struct pdcspath_entry *entry, const char *buf, size_t coun
return -EINVAL; return -EINVAL;
/* We'll use a local copy of buf */ /* We'll use a local copy of buf */
memset(in, 0, count+1); count = min_t(size_t, count, sizeof(in)-1);
strncpy(in, buf, count); strncpy(in, buf, count);
in[count] = '\0';
/* Let's clean up the target. 0xff is a blank pattern */ /* Let's clean up the target. 0xff is a blank pattern */
memset(&hwpath, 0xff, sizeof(hwpath)); memset(&hwpath, 0xff, sizeof(hwpath));
...@@ -393,14 +394,15 @@ pdcspath_layer_write(struct pdcspath_entry *entry, const char *buf, size_t count ...@@ -393,14 +394,15 @@ pdcspath_layer_write(struct pdcspath_entry *entry, const char *buf, size_t count
{ {
unsigned int layers[6]; /* device-specific info (ctlr#, unit#, ...) */ unsigned int layers[6]; /* device-specific info (ctlr#, unit#, ...) */
unsigned short i; unsigned short i;
char in[count+1], *temp; char in[64], *temp;
if (!entry || !buf || !count) if (!entry || !buf || !count)
return -EINVAL; return -EINVAL;
/* We'll use a local copy of buf */ /* We'll use a local copy of buf */
memset(in, 0, count+1); count = min_t(size_t, count, sizeof(in)-1);
strncpy(in, buf, count); strncpy(in, buf, count);
in[count] = '\0';
/* Let's clean up the target. 0 is a blank pattern */ /* Let's clean up the target. 0 is a blank pattern */
memset(&layers, 0, sizeof(layers)); memset(&layers, 0, sizeof(layers));
...@@ -765,7 +767,7 @@ static ssize_t pdcs_auto_write(struct kobject *kobj, ...@@ -765,7 +767,7 @@ static ssize_t pdcs_auto_write(struct kobject *kobj,
return -EINVAL; return -EINVAL;
/* We'll use a local copy of buf */ /* We'll use a local copy of buf */
count = min_t(size_t, count, 7); count = min_t(size_t, count, sizeof(in)-1);
strncpy(in, buf, count); strncpy(in, buf, count);
in[count] = '\0'; in[count] = '\0';
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment