For dgrp, the buffer length of 'nd->nd_ps_desc' is 'MAX_DESC_LEN + 1', so
the buffer length of 'getnode.nd_ps_desc' also need be 'MAX_DESC_LEN + 1',
then can fully copy from 'nd->nd_ps_desc' to 'getnode.nd_ps_desc'.
Signed-off-by: Chen Gang <gang.chen@xxxxxxxxxxx>
---
drivers/staging/dgrp/dgrp_dpa_ops.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/dgrp/dgrp_dpa_ops.c b/drivers/staging/dgrp/dgrp_dpa_ops.c
index d99c227..adf655e 100644
--- a/drivers/staging/dgrp/dgrp_dpa_ops.c
+++ b/drivers/staging/dgrp/dgrp_dpa_ops.c
@@ -66,7 +66,7 @@ struct digi_node {
uint nd_chan_count; /* Number of channels found */
uint nd_tx_byte; /* Tx data count */
uint nd_rx_byte; /* RX data count */
- u8 nd_ps_desc[MAX_DESC_LEN]; /* Description from PS */
+ u8 nd_ps_desc[MAX_DESC_LEN + 1]; /* Description from PS */
};
#define DIGI_GETNODE (('d'<<8) | 249) /* get board info */
@@ -390,7 +390,7 @@ static long dgrp_dpa_ioctl(struct file *file, unsigned int cmd,
getnode.nd_tx_byte = nd->nd_tx_byte;
getnode.nd_rx_byte = nd->nd_rx_byte;
- memset(&getnode.nd_ps_desc, 0, MAX_DESC_LEN);
+ memset(&getnode.nd_ps_desc, 0, MAX_DESC_LEN + 1);
strncpy(getnode.nd_ps_desc, nd->nd_ps_desc, MAX_DESC_LEN);
if (copy_to_user(uarg, &getnode, sizeof(struct digi_node)))
--
1.7.7.6
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
