Input: cyapa - off by on in cyapa_update_fw_store()
Subsystems (3)
PATCH 1/1 Input: cyapa - off by on in cyapa_update_fw_store()
If "(count == NAME_MAX)" then we could end up putting the NUL terminator one space beyond the end of the fw_name[] array.
Signed-off-by Dan Carpenter <[email protected]>
drivers/input/mouse/cyapa.c +1 -1
@@ -1013,7 +1013,7 @@ static ssize_t cyapa_update_fw_store(struct device *dev,char fw_name[NAME_MAX ];int ret, error; -if (count >NAME_MAX ) { +if (count >=NAME_MAX ) {dev_err (dev,"File name too long\n" );return -EINVAL ; }
Quoted 4 lines · Dan Carpenter
If "(count =
NAME_MAX)" then we could end up putting the NUL terminator one space beyond the end of the fw_name[] array.Signed-off-by Dan Carpenter <[email protected]>
Applied, thank you.
Quoted 14 lines
drivers/input/mouse/cyapa.c +1
-1@@ -1013,7 +1013,7 @@ static ssize_t cyapa_update_fw_store(struct device *dev,char fw_name[NAME_MAX ];int ret, error; -if (count >NAME_MAX ) { +if (count >=NAME_MAX ) {dev_err (dev,"File name too long\n" );return -EINVAL ; }
Signature · 1 line
Dmitry