Skip to contentSkip to conversation

drivers/net/wireless/iwlegacy: adding check length for parameter buf

PATCH In review Chen Gang 2 participants 2 messages Jan 20, 2013 1 message not in the archive

Subsystems (3)
lore
Share & tools
lore

Chen Gang

author
#0 lore raw

PATCH 1/1 drivers/net/wireless/iwlegacy: adding check length for parameter buf

the parameter 'const char *buf' may be not '\0' based string. so need check the length before use it.

additinal info:
originally, it had the relative checking.
but it was deleted when fix another issues (using strlcpy instead of
strncpy)
and now, we need restore the checking (but still keep strlcpy)

---
 drivers/net/wireless/iwlegacy/3945-mac.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
(quoted diff) +0 -0

b/drivers/net/wireless/iwlegacy/3945-mac.c
index 050ce7c..71cdbac 100644

drivers/net/wireless/iwlegacy/3945-mac.c +0 -0
@@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct

device_attribute *attr,

if (count) {
char *p = buffer;
- strlcpy(buffer, buf, sizeof(buffer));
+ strlcpy(buffer, buf, min(sizeof(buffer), count));
channel = simple_strtoul(p, NULL, 0); if (channel)
params.channel = channel;

Signature · 1 line
1.7.10.4

A message that is not in the archive (sent off-list or not yet received): [email protected]

#2 lore raw

oh, sorry, it is my fault.

according to fill_write_buffer in fs/sysfs/file.c,
we can assume that 'const char *buf' must be '\0' based string.

please skip this patch.

gchen.

Quoted 31 lines · Chen Gang

the parameter 'const char *buf' may be not '\0' based string. so need check the length before use it.

additinal info:
originally, it had the relative checking.
but it was deleted when fix another issues (using strlcpy instead of
strncpy)
and now, we need restore the checking (but still keep strlcpy)

---
 drivers/net/wireless/iwlegacy/3945-mac.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/iwlegacy/3945-mac.c +1 -1
index 050ce7c..71cdbac 100644
@@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct
 device_attribute *attr,
 
 	if (count) {
 		char *p = buffer;
-		strlcpy(buffer, buf, sizeof(buffer));
+		strlcpy(buffer, buf, min(sizeof(buffer), count));
 		channel = simple_strtoul(p, NULL, 0);
 		if (channel)

params.channel = channel;

Signature · 3 lines
Chen Gang

Flying Transformer

begin:vcard
fn:Chen Gang
n:;Chen Gang
version:2.1
end:vcard