This doesn't happen with the usbip virtual hci module, but another
module wanting to interface with this user space code could cause a
seg-fault by sending data without newlines.
Signed-off-by: Christopher Harvey <charvey@xxxxxxxxxx>
---
.../staging/usbip/userspace/libsrc/vhci_driver.c | 20 ++++++++++++++++----
1 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/usbip/userspace/libsrc/vhci_driver.c b/drivers/staging/usbip/userspace/libsrc/vhci_driver.c
index 2697877..af8e0eb 100644
--- a/drivers/staging/usbip/userspace/libsrc/vhci_driver.c
+++ b/drivers/staging/usbip/userspace/libsrc/vhci_driver.c
@@ -59,7 +59,10 @@ static int parse_status(char *value)
/* skip a header line */
- c = strchr(value, '\n') + 1;
+ c = strchr(value, '\n');
+ if(!c)
+ return -1;
+ c++;
while (*c != '\0') {
int port, status, speed, devid;
@@ -109,7 +112,10 @@ static int parse_status(char *value)
/* go to the next line */
- c = strchr(c, '\n') + 1;
+ c = strchr(c, '\n');
+ if(!c)
+ break;
+ c++;
}
dbg("exit");
@@ -264,11 +270,17 @@ static int get_nports(void)
attr_status->method, attr_status->value);
/* skip a header line */
- c = strchr(attr_status->value, '\n') + 1;
+ c = strchr(attr_status->value, '\n');
+ if(!c)
+ return 0;
+ c++;
while (*c != '\0') {
/* go to the next line */
- c = strchr(c, '\n') + 1;
+ c = strchr(c, '\n');
+ if(!c)
+ return nports;
+ c++;
nports += 1;
}
--
1.7.4.5
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
