提交 f2ac14b5 编写于 作者: A Armin Wolf 提交者: Rafael J. Wysocki

ACPI: battery: Fix missing NUL-termination with large strings

When encountering a string bigger than the destination buffer (32 bytes),
the string is not properly NUL-terminated, causing buffer overreads later.

This for example happens on the Inspiron 3505, where the battery
model name is larger than 32 bytes, which leads to sysfs showing
the model name together with the serial number string (which is
NUL-terminated and thus prevents worse).

Fix this by using strscpy() which ensures that the result is
always NUL-terminated.

Fixes: 106449e8 ("ACPI: Battery: Allow extract string from integer")
Signed-off-by: NArmin Wolf <W_Armin@gmx.de>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
上级 5dc4c995
...@@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery, ...@@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery,
if (element->type == ACPI_TYPE_STRING || if (element->type == ACPI_TYPE_STRING ||
element->type == ACPI_TYPE_BUFFER) element->type == ACPI_TYPE_BUFFER)
strncpy(ptr, element->string.pointer, 32); strscpy(ptr, element->string.pointer, 32);
else if (element->type == ACPI_TYPE_INTEGER) { else if (element->type == ACPI_TYPE_INTEGER) {
strncpy(ptr, (u8 *)&element->integer.value, strncpy(ptr, (u8 *)&element->integer.value,
sizeof(u64)); sizeof(u64));
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册