A character array was declared on the stack with variable length. This has
been corrected to use a fixed length.
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Ken Cox <jkc@xxxxxxxxxx>
---
drivers/staging/unisys/virthba/virthba.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/unisys/virthba/virthba.c b/drivers/staging/unisys/virthba/virthba.c
index c292293..cabd86b 100644
--- a/drivers/staging/unisys/virthba/virthba.c
+++ b/drivers/staging/unisys/virthba/virthba.c
@@ -1439,12 +1439,17 @@ static ssize_t
enable_ints_write(struct file *file, const char __user *buffer,
size_t count, loff_t *ppos)
{
- char buf[count + 1];
+ char buf[4];
int i, new_value;
struct virthba_info *virthbainfo;
U64 *Features_addr;
U64 mask;
+ if (count >= ARRAY_SIZE(buf)) {
+ LOGERR("invalid count<<%lu>>\n", count);
+ return -EINVAL;
+ }
+
buf[count] = '\0';
if (copy_from_user(buf, buffer, count)) {
LOGERR("copy_from_user failed. buf<<%.*s>> count<<%lu>>\n",
--
1.8.5.3
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
