openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

UBI: improve mkvol request validation 

Check that volume name is not shorter than 'name_len'.

No need to copy the trailing zero byte because whole array
was zeroed earlier.

Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
This commit is contained in:
Artem Bityutskiy 2008-07-13 21:46:24 +03:00
parent a5bf619041
commit a6ea440769
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/mtd/ubi/cdev.c
View File

@ -574,6 +574,10 @@ static int verify_mkvol_req(const struct ubi_device *ubi,
goto bad; goto bad;
} }
n = strnlen(req->name, req->name_len + 1);
if (n != req->name_len)
goto bad;
return 0; return 0;
bad: bad:
@ -629,12 +633,11 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
break; break;
} }
req.name[req.name_len] = '\0';
err = verify_mkvol_req(ubi, &req); err = verify_mkvol_req(ubi, &req);
if (err) if (err)
break; break;
req.name[req.name_len] = '\0';
mutex_lock(&ubi->volumes_mutex); mutex_lock(&ubi->volumes_mutex);
err = ubi_create_volume(ubi, &req); err = ubi_create_volume(ubi, &req);
mutex_unlock(&ubi->volumes_mutex); mutex_unlock(&ubi->volumes_mutex);

4
drivers/mtd/ubi/vmt.c
View File

@ -275,7 +275,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
vol->data_pad = ubi->leb_size % vol->alignment; vol->data_pad = ubi->leb_size % vol->alignment;
vol->vol_type = req->vol_type; vol->vol_type = req->vol_type;
vol->name_len = req->name_len; vol->name_len = req->name_len;
memcpy(vol->name, req->name, vol->name_len + 1); memcpy(vol->name, req->name, vol->name_len);
vol->ubi = ubi; vol->ubi = ubi;
/* /*
@ -350,7 +350,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
vtbl_rec.vol_type = UBI_VID_DYNAMIC; vtbl_rec.vol_type = UBI_VID_DYNAMIC;
else else
vtbl_rec.vol_type = UBI_VID_STATIC; vtbl_rec.vol_type = UBI_VID_STATIC;
memcpy(vtbl_rec.name, vol->name, vol->name_len + 1); memcpy(vtbl_rec.name, vol->name, vol->name_len);
err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec); err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec);
if (err) if (err)