[Patch V3] Staging: unisys: virthba: Fix variable length array

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



A character array was declared on the stack with variable length.  This has
been corrected to use a fixed length.

Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Ken Cox <jkc@xxxxxxxxxx>
---
 drivers/staging/unisys/virthba/virthba.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/unisys/virthba/virthba.c b/drivers/staging/unisys/virthba/virthba.c
index c292293..277851f 100644
--- a/drivers/staging/unisys/virthba/virthba.c
+++ b/drivers/staging/unisys/virthba/virthba.c
@@ -1439,12 +1439,15 @@ static ssize_t
 enable_ints_write(struct file *file, const char __user *buffer,
 		  size_t count, loff_t *ppos)
 {
-	char buf[count + 1];
+	char buf[4];
 	int i, new_value;
 	struct virthba_info *virthbainfo;
 	U64 *Features_addr;
 	U64 mask;
 
+	if (count >= ARRAY_SIZE(buf))
+		return -EINVAL;
+
 	buf[count] = '\0';
 	if (copy_from_user(buf, buffer, count)) {
 		LOGERR("copy_from_user failed. buf<<%.*s>> count<<%lu>>\n",
-- 
1.8.5.3

_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel




[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux