Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9cc3fdc8 authored by One Thousand Gnomes's avatar One Thousand Gnomes Committed by Kalle Valo
Browse files

rt2x00: unterminated strlen of user data 



The buffer needs to be zero terminated in case the user data is not.
Otherwise we run off the end of the buffer.

Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Reviewed-by: default avatarJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 7b5acd11

drivers/net/wireless/ralink/rt2x00/rt2x00debug.c

+3 −2
Original line number Diff line number Diff line
@@ -478,7 +478,7 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \ 
{								\

	struct rt2x00debug_intf *intf = file->private_data;	\

	const struct rt2x00debug *debug = intf->debug;		\

	char line[16];						\

	char line[17];						\

	size_t size;						\

	unsigned int index = intf->offset_##__name;		\

	__type value;						\
@@ -494,6 +494,7 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \ 
								\

	if (copy_from_user(line, buf, length))			\

		return -EFAULT;					\

	line[16] = 0;						\

						\

	size = strlen(line);					\

	value = simple_strtoul(line, NULL, 0);			\