* [PATCH] drivers/net/wireless/iwlegacy: adding check length for parameter buf
@ 2013-01-20 9:53 Chen Gang
2013-01-20 10:43 ` Chen Gang F T
0 siblings, 1 reply; 2+ messages in thread
From: Chen Gang @ 2013-01-20 9:53 UTC (permalink / raw)
To: Stanislaw Gruszka, John W. Linville; +Cc: linux-wireless, netdev
the parameter 'const char *buf' may be not '\0' based string.
so need check the length before use it.
additinal info:
originally, it had the relative checking.
but it was deleted when fix another issues (using strlcpy instead of
strncpy)
and now, we need restore the checking (but still keep strlcpy)
Signed-off-by: Chen Gang <gang.chen@asianux.com>
---
drivers/net/wireless/iwlegacy/3945-mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c
b/drivers/net/wireless/iwlegacy/3945-mac.c
index 050ce7c..71cdbac 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct
device_attribute *attr,
if (count) {
char *p = buffer;
- strlcpy(buffer, buf, sizeof(buffer));
+ strlcpy(buffer, buf, min(sizeof(buffer), count));
channel = simple_strtoul(p, NULL, 0);
if (channel)
params.channel = channel;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] drivers/net/wireless/iwlegacy: adding check length for parameter buf
2013-01-20 9:53 [PATCH] drivers/net/wireless/iwlegacy: adding check length for parameter buf Chen Gang
@ 2013-01-20 10:43 ` Chen Gang F T
0 siblings, 0 replies; 2+ messages in thread
From: Chen Gang F T @ 2013-01-20 10:43 UTC (permalink / raw)
To: Chen Gang; +Cc: Stanislaw Gruszka, John W. Linville, linux-wireless, netdev
[-- Attachment #1: Type: text/plain, Size: 1331 bytes --]
oh, sorry, it is my fault.
according to fill_write_buffer in fs/sysfs/file.c,
we can assume that 'const char *buf' must be '\0' based string.
please skip this patch.
gchen.
于 2013年01月20日 17:53, Chen Gang 写道:
>
> the parameter 'const char *buf' may be not '\0' based string.
> so need check the length before use it.
>
> additinal info:
> originally, it had the relative checking.
> but it was deleted when fix another issues (using strlcpy instead of
> strncpy)
> and now, we need restore the checking (but still keep strlcpy)
>
> Signed-off-by: Chen Gang <gang.chen@asianux.com>
> ---
> drivers/net/wireless/iwlegacy/3945-mac.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c
> b/drivers/net/wireless/iwlegacy/3945-mac.c
> index 050ce7c..71cdbac 100644
> --- a/drivers/net/wireless/iwlegacy/3945-mac.c
> +++ b/drivers/net/wireless/iwlegacy/3945-mac.c
> @@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct
> device_attribute *attr,
>
> if (count) {
> char *p = buffer;
> - strlcpy(buffer, buf, sizeof(buffer));
> + strlcpy(buffer, buf, min(sizeof(buffer), count));
> channel = simple_strtoul(p, NULL, 0);
> if (channel)
> params.channel = channel;
>
--
Chen Gang
Flying Transformer
[-- Attachment #2: chen_gang_flying_transformer.vcf --]
[-- Type: text/x-vcard, Size: 67 bytes --]
begin:vcard
fn:Chen Gang
n:;Chen Gang
version:2.1
end:vcard
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-01-20 10:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-01-20 9:53 [PATCH] drivers/net/wireless/iwlegacy: adding check length for parameter buf Chen Gang
2013-01-20 10:43 ` Chen Gang F T
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).