parisc: sys_hpux: NUL terminator is one past the end
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 31 Jul 2014 15:20:20 +0000 (18:20 +0300)
committerHelge Deller <deller@gmx.de>
Wed, 27 Aug 2014 12:33:46 +0000 (14:33 +0200)
We allocate "len" number of chars so we should put the NUL at "len - 1"
to avoid corrupting memory.  Btw, strlen_user() is different from the
normal strlen() function because it includes NUL terminator in the
count.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Helge Deller <deller@gmx.de>
arch/parisc/hpux/sys_hpux.c

index d9dc6cd3b7d2bb549bd7bc24efd2339a894aad0b..e5c4da03581056efc5630c47b3dacdfdc1980c07 100644 (file)
@@ -456,7 +456,7 @@ int hpux_sysfs(int opcode, unsigned long arg1, unsigned long arg2)
                }
 
                /* String could be altered by userspace after strlen_user() */
-               fsname[len] = '\0';
+               fsname[len - 1] = '\0';
 
                printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname);
                if ( !strcmp(fsname, "hfs") ) {