Skip to content

Commit

Permalink
staging: dgrp: fix potential call to strncpy with a negative number
Browse files Browse the repository at this point in the history
In dgrp_receive() there is:

   desclen = ((plen - 12) > MAX_DESC_LEN) ? MAX_DESC_LEN :
   	     	      	    plen - 12;
   strncpy(nd->nd_ps_desc, b + 12, desclen);

However, it's possible for plen to be <= 12 here so we'd be passing a
negative number into the strncpy().  Fix this to not make the strncpy
call and report an error if desclen is <= 0

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bill Pemberton <wfp5p@virginia.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
wfp5p authored and gregkh committed Sep 25, 2012
1 parent 142e546 commit ad0c6e3
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions drivers/staging/dgrp/dgrp_net_ops.c
Original file line number Diff line number Diff line change
Expand Up @@ -3156,6 +3156,12 @@ static void dgrp_receive(struct nd_struct *nd)
nd->nd_hw_id = b[6];
desclen = ((plen - 12) > MAX_DESC_LEN) ? MAX_DESC_LEN :
plen - 12;

if (desclen <= 0) {
error = "Response Packet desclen error";
goto prot_error;
}

strncpy(nd->nd_ps_desc, b + 12, desclen);
nd->nd_ps_desc[desclen] = 0;
}
Expand Down

0 comments on commit ad0c6e3

Please sign in to comment.