evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[BLOCK] fix string handling in elv_iosched_store

Browse source 
elv_iosched_store doesn't terminate string passed from userspace if
it's too long.  Also, if the written length is zero (probably not
possible), it accesses elevator_name[-1].  This patch fixes both bugs.

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jens Axboe <axboe@suse.de>
This commit is contained in:
Tejun Heo 2005-11-10 08:55:01 +01:00 • committed by Jens Axboe
parent 15853af9f0
commit be56123568
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
block/elevator.c
View file

@ -762,13 +762,15 @@ error:
ssize_t elv_iosched_store(request_queue_t *q, const char *name, size_t count) ssize_t elv_iosched_store(request_queue_t *q, const char *name, size_t count)
{ {
char elevator_name[ELV_NAME_MAX]; char elevator_name[ELV_NAME_MAX];
size_t len;
struct elevator_type *e; struct elevator_type *e;
memset(elevator_name, 0, sizeof(elevator_name)); elevator_name[sizeof(elevator_name) - 1] = '\0';
strncpy(elevator_name, name, sizeof(elevator_name)); strncpy(elevator_name, name, sizeof(elevator_name) - 1);
len = strlen(elevator_name);
if (elevator_name[strlen(elevator_name) - 1] == '\n') if (len && elevator_name[len - 1] == '\n')
elevator_name[strlen(elevator_name) - 1] = '\0'; elevator_name[len - 1] = '\0';
e = elevator_get(elevator_name); e = elevator_get(elevator_name);
if (!e) { if (!e) {