diff options
author | Dan Williams <dan.j.williams@gmail.com> | 2008-09-25 01:48:19 -0400 |
---|---|---|
committer | NeilBrown <neilb@suse.de> | 2008-10-16 02:03:08 -0400 |
commit | 97ce0a7f9caf9d715cee815a016ee21575f71c95 (patch) | |
tree | b35d4f84795a9b3f20a22faa43148a9c2c68d051 /drivers | |
parent | 08ff39f1c8f2134f7d0f38123ca5952371665cc5 (diff) |
md: fix input truncation in safe_delay_store()
safe_delay_store() currently truncates the last character of input since
it tells strlcpy that the buffer can only hold 'len' characters, off by
one. sysfs already null terminates the buffer, so just increase the
last argument to strlcpy.
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/md/md.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/drivers/md/md.c b/drivers/md/md.c index 39c9c87a1342..aaa3d465de4e 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c | |||
@@ -2394,12 +2394,11 @@ safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len) | |||
2394 | int i; | 2394 | int i; |
2395 | unsigned long msec; | 2395 | unsigned long msec; |
2396 | char buf[30]; | 2396 | char buf[30]; |
2397 | char *e; | 2397 | |
2398 | /* remove a period, and count digits after it */ | 2398 | /* remove a period, and count digits after it */ |
2399 | if (len >= sizeof(buf)) | 2399 | if (len >= sizeof(buf)) |
2400 | return -EINVAL; | 2400 | return -EINVAL; |
2401 | strlcpy(buf, cbuf, len); | 2401 | strlcpy(buf, cbuf, sizeof(buf)); |
2402 | buf[len] = 0; | ||
2403 | for (i=0; i<len; i++) { | 2402 | for (i=0; i<len; i++) { |
2404 | if (dot) { | 2403 | if (dot) { |
2405 | if (isdigit(buf[i])) { | 2404 | if (isdigit(buf[i])) { |
@@ -2412,8 +2411,7 @@ safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len) | |||
2412 | buf[i] = 0; | 2411 | buf[i] = 0; |
2413 | } | 2412 | } |
2414 | } | 2413 | } |
2415 | msec = simple_strtoul(buf, &e, 10); | 2414 | if (strict_strtoul(buf, 10, &msec) < 0) |
2416 | if (e == buf || (*e && *e != '\n')) | ||
2417 | return -EINVAL; | 2415 | return -EINVAL; |
2418 | msec = (msec * 1000) / scale; | 2416 | msec = (msec * 1000) / scale; |
2419 | if (msec == 0) | 2417 | if (msec == 0) |