提交 66c65d90 编写于 作者: C Craig Markwardt 提交者: Jonathan Cameron

iio: Fix a buffer overflow in iio_utils.h example code

This was originally reported by Craig Markwardt on Zubair Lutfullah's
blog and Zubair forwarded it to linux-iio@vger.kernel.org. No email
address known.

The code first counted the number of enabled channels, then created an
array to hold information about them.  The code that filled this array then
stored whether a given element was enabled inside the array.  Curriously
this element was never used.  Craig's patch added a local temporary variable
to avoid the buffer overrun.  Jonathan then removed the original enabled
element of the structure as it was not needed at all.
Signed-off-by: NZubair Lutfullah <zubair.lutfullah@gmail.com>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>
上级 e9ed104d
......@@ -77,7 +77,6 @@ struct iio_channel_info {
uint64_t mask;
unsigned be;
unsigned is_signed;
unsigned enabled;
unsigned location;
};
......@@ -335,6 +334,7 @@ inline int build_channel_array(const char *device_dir,
while (ent = readdir(dp), ent != NULL) {
if (strcmp(ent->d_name + strlen(ent->d_name) - strlen("_en"),
"_en") == 0) {
int current_enabled = 0;
current = &(*ci_array)[count++];
ret = asprintf(&filename,
"%s/%s", scan_el_dir, ent->d_name);
......@@ -350,10 +350,10 @@ inline int build_channel_array(const char *device_dir,
ret = -errno;
goto error_cleanup_array;
}
fscanf(sysfsfp, "%u", &current->enabled);
fscanf(sysfsfp, "%u", &current_enabled);
fclose(sysfsfp);
if (!current->enabled) {
if (!current_enabled) {
free(filename);
count--;
continue;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册