A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 11:11:45 -04:00
Code Issues Projects Releases Packages Wiki Activity

md: fix input truncation in safe_delay_store()

Browse source 
safe_delay_store() currently truncates the last character of input since
it tells strlcpy that the buffer can only hold 'len' characters, off by
one.  sysfs already null terminates the buffer, so just increase the
last argument to strlcpy.

Signed-off-by: Dan Williams <[email protected]>
Signed-off-by: NeilBrown <[email protected]>
This commit is contained in:
Dan Williams 2008-09-24 22:48:19 -07:00 • committed by NeilBrown
commit 97ce0a7f9c
1 changed files with 3 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/md/md.c
View file

@ -2394,12 +2394,11 @@ safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len)
int i;
unsigned long msec;
char buf[30];
char *e;
/* remove a period, and count digits after it */
if (len >= sizeof(buf))
return -EINVAL;
strlcpy(buf, cbuf, len);
buf[len] = 0;
strlcpy(buf, cbuf, sizeof(buf));
for (i=0; i<len; i++) {
if (dot) {
if (isdigit(buf[i])) {
@ -2412,8 +2411,7 @@ safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len)
buf[i] = 0;
}
}
msec = simple_strtoul(buf, &e, 10);
if (e == buf || (*e && *e != '\n'))
if (strict_strtoul(buf, 10, &msec) < 0)
return -EINVAL;
msec = (msec * 1000) / scale;
if (msec == 0)