提交 1cc8d841 编写于 作者: B Brian Norris

mtd: terminate user-provided string

Noticed by Coverity as a potential security issue.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
上级 537ab1bd
...@@ -549,6 +549,9 @@ static int mtdchar_blkpg_ioctl(struct mtd_info *mtd, ...@@ -549,6 +549,9 @@ static int mtdchar_blkpg_ioctl(struct mtd_info *mtd,
if (mtd_is_partition(mtd)) if (mtd_is_partition(mtd))
return -EINVAL; return -EINVAL;
/* Sanitize user input */
p.devname[BLKPG_DEVNAMELTH - 1] = '\0';
return mtd_add_partition(mtd, p.devname, p.start, p.length); return mtd_add_partition(mtd, p.devname, p.start, p.length);
case BLKPG_DEL_PARTITION: case BLKPG_DEL_PARTITION:
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册