diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-07-31 18:20:20 +0300 |
|---|---|---|
| committer | Helge Deller <deller@gmx.de> | 2014-08-27 14:33:46 +0200 |
| commit | 3067bbd1ad8601418a32b839f7a8a2fee9b44bd1 (patch) | |
| tree | e1904a8727024097863224b71347a641d587bd0e /arch/parisc | |
| parent | 68e370289c29e3beac99d59c6d840d470af9dfcf (diff) | |
| download | linux-rpi3-3067bbd1ad8601418a32b839f7a8a2fee9b44bd1.tar.gz linux-rpi3-3067bbd1ad8601418a32b839f7a8a2fee9b44bd1.tar.bz2 linux-rpi3-3067bbd1ad8601418a32b839f7a8a2fee9b44bd1.zip | |
parisc: sys_hpux: NUL terminator is one past the end
We allocate "len" number of chars so we should put the NUL at "len - 1"
to avoid corrupting memory. Btw, strlen_user() is different from the
normal strlen() function because it includes NUL terminator in the
count.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Diffstat (limited to 'arch/parisc')
| -rw-r--r-- | arch/parisc/hpux/sys_hpux.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/parisc/hpux/sys_hpux.c b/arch/parisc/hpux/sys_hpux.c index d9dc6cd3b7d2..e5c4da035810 100644 --- a/arch/parisc/hpux/sys_hpux.c +++ b/arch/parisc/hpux/sys_hpux.c @@ -456,7 +456,7 @@ int hpux_sysfs(int opcode, unsigned long arg1, unsigned long arg2) } /* String could be altered by userspace after strlen_user() */ - fsname[len] = '\0'; + fsname[len - 1] = '\0'; printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname); if ( !strcmp(fsname, "hfs") ) { |