redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

parisc: memory overflow, 'name' length is too short for using

Browse source 
'path.bc[i]' can be asigned by PCI_SLOT() which can '> 10', so sizeof(6
* "%u:" + "%u" + '\0') may be 21.

Since 'name' length is 20, it may be memory overflow.

And 'path.bc[i]' is 'unsigned char' for printing, we can be sure the
max length of 'name' must be less than 28.

So simplify thinking, we can use 28 instead of 20 directly, and do not
think of whether 'patchc.bc[i]' can '> 100'.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Helge Deller <deller@gmx.de>
This commit is contained in:
Chen Gang 2013-05-27 04:57:09 +00:00 committed by Helge Deller
parent 0f7dafd44e
commit 3f108de96b
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
arch/parisc/kernel/drivers.c
View file

@ -394,7 +394,7 @@ EXPORT_SYMBOL(print_pci_hwpath);
static void setup_bus_id(struct parisc_device *padev) static void setup_bus_id(struct parisc_device *padev)
{ {
struct hardware_path path; struct hardware_path path;
char name[20]; char name[28];
char *output = name; char *output = name;
int i; int i;