diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-07-31 11:20:20 -0400 |
---|---|---|
committer | Helge Deller <deller@gmx.de> | 2014-08-27 08:33:46 -0400 |
commit | 3067bbd1ad8601418a32b839f7a8a2fee9b44bd1 (patch) | |
tree | e1904a8727024097863224b71347a641d587bd0e /arch | |
parent | 68e370289c29e3beac99d59c6d840d470af9dfcf (diff) |
parisc: sys_hpux: NUL terminator is one past the end
We allocate "len" number of chars so we should put the NUL at "len - 1"
to avoid corrupting memory. Btw, strlen_user() is different from the
normal strlen() function because it includes NUL terminator in the
count.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Diffstat (limited to 'arch')
-rw-r--r-- | arch/parisc/hpux/sys_hpux.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/parisc/hpux/sys_hpux.c b/arch/parisc/hpux/sys_hpux.c index d9dc6cd3b7d2..e5c4da035810 100644 --- a/arch/parisc/hpux/sys_hpux.c +++ b/arch/parisc/hpux/sys_hpux.c | |||
@@ -456,7 +456,7 @@ int hpux_sysfs(int opcode, unsigned long arg1, unsigned long arg2) | |||
456 | } | 456 | } |
457 | 457 | ||
458 | /* String could be altered by userspace after strlen_user() */ | 458 | /* String could be altered by userspace after strlen_user() */ |
459 | fsname[len] = '\0'; | 459 | fsname[len - 1] = '\0'; |
460 | 460 | ||
461 | printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname); | 461 | printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname); |
462 | if ( !strcmp(fsname, "hfs") ) { | 462 | if ( !strcmp(fsname, "hfs") ) { |