Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit e898893399335514b10dfbd75598f8308976abe4

Authored by Michael Buesch
Committed by Linus Torvalds
1 parent c02e3f361c
Exists in master and in 20 other branches dlt-processor-sdk-linux-03.00.00.04, newt-ti-linux-3.12.y, processor-sdk-linux-01.00.00, processor-sdk-linux-02.00.01, smarc-ti-linux-3.12.10, smarc-ti-linux-3.12.y, smarc-ti-linux-3.14.y, smarc-ti-linux-3.15.y, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04, ti-linux-3.12.y, ti-linux-3.14.y, ti-linux-3.15.y, ti-lsk-linux-4.1.y

dac960: fix undefined behavior on empty string 

Fix undefined behavior due to a buffer underrun if an empty string is
written to the proc file.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff

drivers/block/DAC960.c
Diff comments   View file @ e898893
... ... @@ -6562,7 +6562,7 @@
6562 6562 if (copy_from_user(CommandBuffer, Buffer, Count)) return -EFAULT;
6563 6563 CommandBuffer[Count] = '\0';
6564 6564 Length = strlen(CommandBuffer);
6565   - if (CommandBuffer[Length-1] == '\n')
  6565 + if (Length > 0 && CommandBuffer[Length-1] == '\n')
6566 6566 CommandBuffer[--Length] = '\0';
6567 6567 if (Controller->FirmwareType == DAC960_V1_Controller)
6568 6568 return (DAC960_V1_ExecuteUserCommand(Controller, CommandBuffer)