From patchwork Sun Jan 20 09:53:54 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chen Gang X-Patchwork-Id: 213948 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id F25E12C0082 for ; Sun, 20 Jan 2013 20:53:13 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751404Ab3ATJxJ (ORCPT ); Sun, 20 Jan 2013 04:53:09 -0500 Received: from intranet.asianux.com ([58.214.24.6]:18632 "EHLO intranet.asianux.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751061Ab3ATJxH (ORCPT ); Sun, 20 Jan 2013 04:53:07 -0500 Received: by intranet.asianux.com (Postfix, from userid 103) id 305CA1840275; Sun, 20 Jan 2013 17:53:06 +0800 (CST) X-Spam-Score: -100.5 X-Spam-Checker-Version: SpamAssassin 3.1.9 (2007-02-13) on intranet.asianux.com X-Spam-Level: X-Spam-Status: No, score=-100.5 required=5.0 tests=AWL,BAYES_00, RATWARE_GECKO_BUILD, TW_CP, USER_IN_WHITELIST autolearn=no version=3.1.9 Received: from [10.1.0.143] (unknown [219.143.36.82]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by intranet.asianux.com (Postfix) with ESMTP id DD5A71840242; Sun, 20 Jan 2013 17:53:05 +0800 (CST) Message-ID: <50FBBEB2.2000306@asianux.com> Date: Sun, 20 Jan 2013 17:53:54 +0800 From: Chen Gang User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Stanislaw Gruszka , "John W. Linville" CC: linux-wireless@vger.kernel.org, netdev Subject: [PATCH] drivers/net/wireless/iwlegacy: adding check length for parameter buf Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org the parameter 'const char *buf' may be not '\0' based string. so need check the length before use it. additinal info: originally, it had the relative checking. but it was deleted when fix another issues (using strlcpy instead of strncpy) and now, we need restore the checking (but still keep strlcpy) Signed-off-by: Chen Gang --- drivers/net/wireless/iwlegacy/3945-mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) params.channel = channel; diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c index 050ce7c..71cdbac 100644 --- a/drivers/net/wireless/iwlegacy/3945-mac.c +++ b/drivers/net/wireless/iwlegacy/3945-mac.c @@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr, if (count) { char *p = buffer; - strlcpy(buffer, buf, sizeof(buffer)); + strlcpy(buffer, buf, min(sizeof(buffer), count)); channel = simple_strtoul(p, NULL, 0); if (channel)