diff options
author | Artem Bityutskiy <Artem.Bityutskiy@nokia.com> | 2008-07-13 14:46:24 -0400 |
---|---|---|
committer | Artem Bityutskiy <Artem.Bityutskiy@nokia.com> | 2008-07-24 06:32:56 -0400 |
commit | a6ea440769e11c46828cddd20f91ab57261701d5 (patch) | |
tree | 19994608d2721de6484310c60e4a3ff1414cb1ef /drivers/mtd/ubi/vmt.c | |
parent | a5bf6190417cbbf80443a9f71c65b653e13e9982 (diff) |
UBI: improve mkvol request validation
Check that volume name is not shorter than 'name_len'.
No need to copy the trailing zero byte because whole array
was zeroed earlier.
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Diffstat (limited to 'drivers/mtd/ubi/vmt.c')
-rw-r--r-- | drivers/mtd/ubi/vmt.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c index 367b04176e0a..bfa7c5d2e064 100644 --- a/drivers/mtd/ubi/vmt.c +++ b/drivers/mtd/ubi/vmt.c | |||
@@ -275,7 +275,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) | |||
275 | vol->data_pad = ubi->leb_size % vol->alignment; | 275 | vol->data_pad = ubi->leb_size % vol->alignment; |
276 | vol->vol_type = req->vol_type; | 276 | vol->vol_type = req->vol_type; |
277 | vol->name_len = req->name_len; | 277 | vol->name_len = req->name_len; |
278 | memcpy(vol->name, req->name, vol->name_len + 1); | 278 | memcpy(vol->name, req->name, vol->name_len); |
279 | vol->ubi = ubi; | 279 | vol->ubi = ubi; |
280 | 280 | ||
281 | /* | 281 | /* |
@@ -350,7 +350,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) | |||
350 | vtbl_rec.vol_type = UBI_VID_DYNAMIC; | 350 | vtbl_rec.vol_type = UBI_VID_DYNAMIC; |
351 | else | 351 | else |
352 | vtbl_rec.vol_type = UBI_VID_STATIC; | 352 | vtbl_rec.vol_type = UBI_VID_STATIC; |
353 | memcpy(vtbl_rec.name, vol->name, vol->name_len + 1); | 353 | memcpy(vtbl_rec.name, vol->name, vol->name_len); |
354 | 354 | ||
355 | err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec); | 355 | err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec); |
356 | if (err) | 356 | if (err) |