Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

parisc: pdc_stable.c: Avoid potential stack overflows

Signed-off-by: Helge Deller <deller@gmx.de>

+7 -5
+7 -5
drivers/parisc/pdc_stable.c
··· 278 278 { 279 279 struct hardware_path hwpath; 280 280 unsigned short i; 281 - char in[count+1], *temp; 281 + char in[64], *temp; 282 282 struct device *dev; 283 283 int ret; 284 284 ··· 286 286 return -EINVAL; 287 287 288 288 /* We'll use a local copy of buf */ 289 - memset(in, 0, count+1); 289 + count = min_t(size_t, count, sizeof(in)-1); 290 290 strncpy(in, buf, count); 291 + in[count] = '\0'; 291 292 292 293 /* Let's clean up the target. 0xff is a blank pattern */ 293 294 memset(&hwpath, 0xff, sizeof(hwpath)); ··· 394 393 { 395 394 unsigned int layers[6]; /* device-specific info (ctlr#, unit#, ...) */ 396 395 unsigned short i; 397 - char in[count+1], *temp; 396 + char in[64], *temp; 398 397 399 398 if (!entry || !buf || !count) 400 399 return -EINVAL; 401 400 402 401 /* We'll use a local copy of buf */ 403 - memset(in, 0, count+1); 402 + count = min_t(size_t, count, sizeof(in)-1); 404 403 strncpy(in, buf, count); 404 + in[count] = '\0'; 405 405 406 406 /* Let's clean up the target. 0 is a blank pattern */ 407 407 memset(&layers, 0, sizeof(layers)); ··· 767 765 return -EINVAL; 768 766 769 767 /* We'll use a local copy of buf */ 770 - count = min_t(size_t, count, 7); 768 + count = min_t(size_t, count, sizeof(in)-1); 771 769 strncpy(in, buf, count); 772 770 in[count] = '\0'; 773 771