Commit b4810773 authored Jan 22, 2015 by Dan Carpenter Committed by Dmitry Torokhov Jan 22, 2015

Input: cyapa - off by one in cyapa_update_fw_store()



If "(count == NAME_MAX)" then we could end up putting the NUL terminator
one space beyond the end of the fw_name[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

parent a535a9f1

drivers/input/mouse/cyapa.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1013,7 +1013,7 @@ static ssize_t cyapa_update_fw_store(struct device *dev,
		char fw_name[NAME_MAX];
		int ret, error;

		if (count > NAME_MAX) {
		if (count >= NAME_MAX) {
		dev_err(dev, "File name too long\n");
		return -EINVAL;
		}