From: Helge Deller <deller@gmx.de>
Date: Sun, 21 Sep 2014 20:31:08 +0000 (+0200)
Subject: parisc: pdc_stable.c: Avoid potential stack overflows
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=c735483de1a2cd5d6c6b67bf49cfb2991eae6ea6;p=linux.git

parisc: pdc_stable.c: Avoid potential stack overflows

Signed-off-by: Helge Deller <deller@gmx.de>
---

diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index e4b73c2a053af..3651c3871d5b4 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -278,7 +278,7 @@ pdcspath_hwpath_write(struct pdcspath_entry *entry, const char *buf, size_t coun
 {
 	struct hardware_path hwpath;
 	unsigned short i;
-	char in[count+1], *temp;
+	char in[64], *temp;
 	struct device *dev;
 	int ret;
 
@@ -286,8 +286,9 @@ pdcspath_hwpath_write(struct pdcspath_entry *entry, const char *buf, size_t coun
 		return -EINVAL;
 
 	/* We'll use a local copy of buf */
-	memset(in, 0, count+1);
+	count = min_t(size_t, count, sizeof(in)-1);
 	strncpy(in, buf, count);
+	in[count] = '\0';
 	
 	/* Let's clean up the target. 0xff is a blank pattern */
 	memset(&hwpath, 0xff, sizeof(hwpath));
@@ -393,14 +394,15 @@ pdcspath_layer_write(struct pdcspath_entry *entry, const char *buf, size_t count
 {
 	unsigned int layers[6]; /* device-specific info (ctlr#, unit#, ...) */
 	unsigned short i;
-	char in[count+1], *temp;
+	char in[64], *temp;
 
 	if (!entry || !buf || !count)
 		return -EINVAL;
 
 	/* We'll use a local copy of buf */
-	memset(in, 0, count+1);
+	count = min_t(size_t, count, sizeof(in)-1);
 	strncpy(in, buf, count);
+	in[count] = '\0';
 	
 	/* Let's clean up the target. 0 is a blank pattern */
 	memset(&layers, 0, sizeof(layers));
@@ -765,7 +767,7 @@ static ssize_t pdcs_auto_write(struct kobject *kobj,
 		return -EINVAL;
 
 	/* We'll use a local copy of buf */
-	count = min_t(size_t, count, 7);
+	count = min_t(size_t, count, sizeof(in)-1);
 	strncpy(in, buf, count);
 	in[count] = '\0';