U-Boot Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [U-Boot] [PATCH 1/3] ubifs: BUG realpath string must be ended with NULL
@ 2009-04-27 11:21 Ricardo Ribalda Delgado
  2009-04-27 11:21 ` [U-Boot] [PATCH 2/3] lib_generic: gunzip: New function zunzip Ricardo Ribalda Delgado
  2009-04-27 12:32 ` [U-Boot] [PATCH 1/3] ubifs: BUG realpath string must be ended with NULL Wolfgang Denk
  0 siblings, 2 replies; 16+ messages in thread
From: Ricardo Ribalda Delgado @ 2009-04-27 11:21 UTC (permalink / raw)
  To: u-boot

If the memory used to copy the link_make is "dirty" the string wont
be ended with NULL, throwing out multiple memory bugs.

Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@uam.es>
---
 fs/ubifs/ubifs.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/fs/ubifs/ubifs.c b/fs/ubifs/ubifs.c
index 32f9ff8..427d84a 100644
--- a/fs/ubifs/ubifs.c
+++ b/fs/ubifs/ubifs.c
@@ -641,6 +641,7 @@ int ubifs_load(char *filename, u32 addr, u32 size)
 	ui = ubifs_inode(inode);
 	if (((inode->i_mode & S_IFMT) == S_IFLNK) && ui->data_len) {
 		memcpy(link_name, ui->data, ui->data_len);
+		link_name[ui->data_len] = '\0';
 		printf("%s is linked to %s!\n", filename, link_name);
 		ubifs_iput(inode);
 
-- 
1.6.2.4

^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [U-Boot] [PATCH 1/3] ubifs: BUG realpath string must be ended with NULL
@ 2009-04-27 16:33 Ricardo Ribalda Delgado
  2009-04-27 16:33 ` [U-Boot] [PATCH 2/3] lib_generic: gunzip: New function zunzip Ricardo Ribalda Delgado
  0 siblings, 1 reply; 16+ messages in thread
From: Ricardo Ribalda Delgado @ 2009-04-27 16:33 UTC (permalink / raw)
  To: u-boot

If the memory used to copy the link_name is "dirty" the string wont
be ended with NULL, throwing out multiple memory bugs.

Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@uam.es>
---
v3: link_make -> link_name

 fs/ubifs/ubifs.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/fs/ubifs/ubifs.c b/fs/ubifs/ubifs.c
index 32f9ff8..427d84a 100644
--- a/fs/ubifs/ubifs.c
+++ b/fs/ubifs/ubifs.c
@@ -641,6 +641,7 @@ int ubifs_load(char *filename, u32 addr, u32 size)
 	ui = ubifs_inode(inode);
 	if (((inode->i_mode & S_IFMT) == S_IFLNK) && ui->data_len) {
 		memcpy(link_name, ui->data, ui->data_len);
+		link_name[ui->data_len] = '\0';
 		printf("%s is linked to %s!\n", filename, link_name);
 		ubifs_iput(inode);
 
-- 
1.6.2.4

^ permalink raw reply related	[flat|nested] 16+ messages in thread

end of thread, other threads:[~2009-04-28 12:43 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-04-27 11:21 [U-Boot] [PATCH 1/3] ubifs: BUG realpath string must be ended with NULL Ricardo Ribalda Delgado
2009-04-27 11:21 ` [U-Boot] [PATCH 2/3] lib_generic: gunzip: New function zunzip Ricardo Ribalda Delgado
2009-04-27 11:21   ` [U-Boot] [PATCH 3/3] ubifs: BUG: Blocks commpressed with zlib Ricardo Ribalda Delgado
2009-04-27 12:36     ` Wolfgang Denk
2009-04-27 15:44       ` Stefan Roese
2009-04-27 16:00       ` Mike Frysinger
2009-04-27 19:46         ` Wolfgang Denk
2009-04-27 20:44           ` Mike Frysinger
2009-04-27 23:26             ` Wolfgang Denk
2009-04-28  7:42               ` Ricardo Ribalda Delgado
2009-04-28 12:43                 ` Mike Frysinger
2009-04-27 16:25       ` Ricardo Ribalda Delgado
2009-04-27 23:25         ` Wolfgang Denk
2009-04-27 12:34   ` [U-Boot] [PATCH 2/3] lib_generic: gunzip: New function zunzip Wolfgang Denk
2009-04-27 12:32 ` [U-Boot] [PATCH 1/3] ubifs: BUG realpath string must be ended with NULL Wolfgang Denk
  -- strict thread matches above, loose matches on Subject: below --
2009-04-27 16:33 Ricardo Ribalda Delgado
2009-04-27 16:33 ` [U-Boot] [PATCH 2/3] lib_generic: gunzip: New function zunzip Ricardo Ribalda Delgado
2009-04-27 16:33   ` [U-Boot] [PATCH 3/3] ubifs: BUG: Blocks commpressed with zlib Ricardo Ribalda Delgado

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox