diff options
| author | Mathias Krause <minipli@googlemail.com> | 2013-05-31 23:24:29 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-06-03 13:55:02 -0700 |
| commit | a3b2c8c7aa1ca860edcf0b0afa371d9eb2269c3c (patch) | |
| tree | 45f73dde89f44a0dd67e26859effd3cbe90286d8 /fs/debugfs | |
| parent | 3a76e5e09fbb51e756b4e732e3e65446f4984cf5 (diff) | |
| download | linux-a3b2c8c7aa1ca860edcf0b0afa371d9eb2269c3c.tar.gz linux-a3b2c8c7aa1ca860edcf0b0afa371d9eb2269c3c.tar.bz2 linux-a3b2c8c7aa1ca860edcf0b0afa371d9eb2269c3c.zip | |
debugfs: write_file_bool() - ensure strtobool() operates on valid data
In case, userland writes an empty string to a bool debugfs file, buf[]
will still be uninitialized when being passed to strtobool() making the
outcome of that function purely random.
Fix this by always zero-terminating the buffer.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/debugfs')
| -rw-r--r-- | fs/debugfs/file.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c index ff64bcd5b8fb..63146295153b 100644 --- a/fs/debugfs/file.c +++ b/fs/debugfs/file.c @@ -473,6 +473,7 @@ static ssize_t write_file_bool(struct file *file, const char __user *user_buf, if (copy_from_user(buf, user_buf, buf_size)) return -EFAULT; + buf[buf_size] = '\0'; if (strtobool(buf, &bv) == 0) *val = bv; |