Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d5b4c2f4 authored by Chen Gang's avatar Chen Gang Committed by Martin Schwidefsky
Browse files

arch: s390: appldata: using strncpy() and strnlen() instead of sprintf() 



'buf[2]' is 2 bytes length, and sprintf() will append '\0' at the end
of string "?\n", so original implementation is memory overflow.

Need use strncpy() and strnlen() instead of sprintf().

Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
Signed-off-by: default avatarGerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 9acf73b7

arch/s390/appldata/appldata_base.c

+5 −2
Original line number Diff line number Diff line
@@ -212,7 +212,9 @@ appldata_timer_handler(ctl_table *ctl, int write, 
		return 0;

	}

	if (!write) {

		len = sprintf(buf, appldata_timer_active ? "1\n" : "0\n");

		strncpy(buf, appldata_timer_active ? "1\n" : "0\n",

			ARRAY_SIZE(buf));

		len = strnlen(buf, ARRAY_SIZE(buf));

		if (len > *lenp)

			len = *lenp;

		if (copy_to_user(buffer, buf, len))
@@ -317,7 +319,8 @@ appldata_generic_handler(ctl_table *ctl, int write, 
		return 0;

	}

	if (!write) {

		len = sprintf(buf, ops->active ? "1\n" : "0\n");

		strncpy(buf, ops->active ? "1\n" : "0\n", ARRAY_SIZE(buf));

		len = strnlen(buf, ARRAY_SIZE(buf));

		if (len > *lenp)

			len = *lenp;

		if (copy_to_user(buffer, buf, len)) {