This patch uses strlcpy to copy data provided by userspace in order to not overflow the allocated space. Signed-off-by: Christian Gromm <christian.gromm@xxxxxxxxxxxxx> --- v2: This patch has beed added to the series. drivers/staging/most/configfs.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/staging/most/configfs.c b/drivers/staging/most/configfs.c index d671022..9fbcadf 100644 --- a/drivers/staging/most/configfs.c +++ b/drivers/staging/most/configfs.c @@ -197,7 +197,7 @@ static ssize_t mdev_link_device_store(struct config_item *item, { struct mdev_link *mdev_link = to_mdev_link(item); - strcpy(mdev_link->device, page); + strlcpy(mdev_link->device, page, sizeof(mdev_link->device)); strim(mdev_link->device); return count; } @@ -212,7 +212,7 @@ static ssize_t mdev_link_channel_store(struct config_item *item, { struct mdev_link *mdev_link = to_mdev_link(item); - strcpy(mdev_link->channel, page); + strlcpy(mdev_link->channel, page, sizeof(mdev_link->channel)); strim(mdev_link->channel); return count; } @@ -227,7 +227,8 @@ static ssize_t mdev_link_comp_store(struct config_item *item, { struct mdev_link *mdev_link = to_mdev_link(item); - strcpy(mdev_link->comp, page); + strlcpy(mdev_link->comp, page, sizeof(mdev_link->comp)); + strim(mdev_link->comp); return count; } @@ -242,7 +243,8 @@ static ssize_t mdev_link_comp_params_store(struct config_item *item, { struct mdev_link *mdev_link = to_mdev_link(item); - strcpy(mdev_link->comp_params, page); + strlcpy(mdev_link->comp_params, page, sizeof(mdev_link->comp_params)); + strim(mdev_link->comp_params); return count; } -- 2.7.4 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel