diff options
| author | Srinivasarao P <spathi@codeaurora.org> | 2016-06-06 12:33:50 +0530 |
|---|---|---|
| committer | Puja Gupta <pujag@codeaurora.org> | 2016-08-03 17:02:32 -0700 |
| commit | febb3a56566553b94074641d3808fe378bdf08b5 (patch) | |
| tree | 377dc7b7ba213dc6b4eced8e966262ab625de128 /drivers/soc | |
| parent | 059df41e860f67a9ba59ff4af2c95d754d6e4a28 (diff) | |
qcom: ssr: Fix possible overflow when copying firmware name
Array overflow can occur in firmware_name_store(), if the variable
buf contains the string larger than size of subsys->desc->fw_name
CRs-Fixed: 1050153
Change-Id: Ice39d7a1eb0b5f53125cc5d528021a99b9f7ff90
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Diffstat (limited to 'drivers/soc')
| -rw-r--r-- | drivers/soc/qcom/subsystem_restart.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/soc/qcom/subsystem_restart.c b/drivers/soc/qcom/subsystem_restart.c index 32041c17d88f..0ed8a6533e00 100644 --- a/drivers/soc/qcom/subsystem_restart.c +++ b/drivers/soc/qcom/subsystem_restart.c @@ -268,7 +268,8 @@ static ssize_t firmware_name_store(struct device *dev, pr_info("Changing subsys fw_name to %s\n", buf); mutex_lock(&track->lock); - strlcpy(subsys->desc->fw_name, buf, count + 1); + strlcpy(subsys->desc->fw_name, buf, + min(count + 1, sizeof(subsys->desc->fw_name))); mutex_unlock(&track->lock); return orig_count; } |