* [patch] [PARISC] sys_hpux: NUL terminator is one past the end
@ 2014-07-31 15:20 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2014-07-31 15:20 UTC (permalink / raw)
To: James E.J. Bottomley; +Cc: Helge Deller, linux-parisc, kernel-janitors
We allocate "len" number of chars so we should put the NUL at "len - 1"
to avoid corrupting memory. Btw, strlen_user() is different from the
normal strlen() function because it includes NUL terminator in the
count.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/arch/parisc/hpux/sys_hpux.c b/arch/parisc/hpux/sys_hpux.c
index d9dc6cd..e5c4da0 100644
--- a/arch/parisc/hpux/sys_hpux.c
+++ b/arch/parisc/hpux/sys_hpux.c
@@ -456,7 +456,7 @@ int hpux_sysfs(int opcode, unsigned long arg1, unsigned long arg2)
}
/* String could be altered by userspace after strlen_user() */
- fsname[len] = '\0';
+ fsname[len - 1] = '\0';
printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname);
if ( !strcmp(fsname, "hfs") ) {
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2014-07-31 15:20 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-07-31 15:20 [patch] [PARISC] sys_hpux: NUL terminator is one past the end Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox