Martchus
/
mdadm
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix for buffer overflow defect in 'link'. 

Potential buffer overflow of 'link' caused by user input may occur,
due to non null-terminated string 'link'.

Signed-off-by: Artur Wojcik <artur.wojcik@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
This commit is contained in:
Artur Wojcik 2009-12-10 11:52:23 -07:00 committed by Dan Williams
parent 2ed4f75388
commit 5a1920f2c2
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
platform-intel.c
View File

@ -57,13 +57,17 @@ struct sys_dev *find_driver_devices(const char *bus, const char *driver)
if (!driver_dir)
return NULL;
for (de = readdir(driver_dir); de; de = readdir(driver_dir)) {
int n;
/* is 'de' a device? check that the 'subsystem' link exists and
* that its target matches 'bus'
*/
sprintf(path, "/sys/bus/%s/drivers/%s/%s/subsystem",
bus, driver, de->d_name);
if (readlink(path, link, sizeof(link)) < 0)
n = readlink(path, link, sizeof(link));
if (n < 0 || n >= sizeof(link))
continue;
link[n] = '\0';
c = strrchr(link, '/');
if (!c)
continue;