sys_hpux: NUL terminator is one past the end

PATCH New Dan Carpenter 1 participant 1 message Jul 31, 2014

Subsystems (2)

Kernel janitors PA-RISC architecture

lore

Share & tools

lore

Dan Carpenter

author

2014-07-31 15:20 UTC #0 lore raw

PATCH 1/1 sys_hpux: NUL terminator is one past the end

We allocate "len" number of chars so we should put the NUL at "len - 1" to avoid corrupting memory. Btw, strlen_user() is different from the normal strlen() function because it includes NUL terminator in the count.

Signed-off-by Dan Carpenter <[email protected]>

arch/parisc/hpux/sys_hpux.c +1 -1

index d9dc6cd..e5c4da0 100644
@@ -456,7 +456,7 @@ int hpux_sysfs(int opcode, unsigned long arg1, unsigned long arg2)
 		}
 
 		/* String could be altered by userspace after strlen_user() */
-		fsname[len] = '\0';
+		fsname[len - 1] = '\0';
 
 		printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname);
 		if ( !strcmp(fsname, "hfs") ) {