The fields must be null-terminated, or simple_strtoul will cause issue.
Signed-off-by: Chen Gang <[email protected]>
---
drivers/net/wireless/iwlegacy/3945-mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index d604b40..3726cd6 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
if (count) {
char *p = buffer;
- strncpy(buffer, buf, min(sizeof(buffer), count));
+ strlcpy(buffer, buf, sizeof(buffer));
channel = simple_strtoul(p, NULL, 0);
if (channel)
params.channel = channel;
--
1.7.10.4
oh, sorry, it is my fault.
according to fill_write_buffer in fs/sysfs/file.c,
we can assume that 'const char *buf' must be '\0' based string.
please skip original reply.
gchen.
?? 2013??01??20?? 17:31, Chen Gang д??:
> Hello all:
>
> sorry, after checking the details:
> I think this patch is incorrect.
> we can not assume that the parameter "char *buf" is terminated by '\0'
> so we should only use strlcpy instead of strncpy, without touching 'min(...'
>
> since it is already integrated into main branch (at least, in next-20130118).
> I should send additional patch to fix it.
>
> please help to check, thanks.
>
>
> gchen.
>
>
> ?? 2013??01??07?? 12:42, Chen Gang д??:
>>
>> The fields must be null-terminated, or simple_strtoul will cause issue.
>>
>> Signed-off-by: Chen Gang <[email protected]>
>> ---
>> drivers/net/wireless/iwlegacy/3945-mac.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
>> index d604b40..3726cd6 100644
>> --- a/drivers/net/wireless/iwlegacy/3945-mac.c
>> +++ b/drivers/net/wireless/iwlegacy/3945-mac.c
>> @@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
>>
>> if (count) {
>> char *p = buffer;
>> - strncpy(buffer, buf, min(sizeof(buffer), count));
>> + strlcpy(buffer, buf, sizeof(buffer));
>> channel = simple_strtoul(p, NULL, 0);
>> if (channel)
>> params.channel = channel;
>>
>
>
--
Chen Gang
Flying Transformer
Hello all:
sorry, after checking the details:
I think this patch is incorrect.
we can not assume that the parameter "char *buf" is terminated by '\0'
so we should only use strlcpy instead of strncpy, without touching 'min(...'
since it is already integrated into main branch (at least, in next-20130118).
I should send additional patch to fix it.
please help to check, thanks.
gchen.
?? 2013??01??07?? 12:42, Chen Gang д??:
>
> The fields must be null-terminated, or simple_strtoul will cause issue.
>
> Signed-off-by: Chen Gang <[email protected]>
> ---
> drivers/net/wireless/iwlegacy/3945-mac.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
> index d604b40..3726cd6 100644
> --- a/drivers/net/wireless/iwlegacy/3945-mac.c
> +++ b/drivers/net/wireless/iwlegacy/3945-mac.c
> @@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
>
> if (count) {
> char *p = buffer;
> - strncpy(buffer, buf, min(sizeof(buffer), count));
> + strlcpy(buffer, buf, sizeof(buffer));
> channel = simple_strtoul(p, NULL, 0);
> if (channel)
> params.channel = channel;
>
--
Chen Gang
Asianux Corporation
On Mon, Jan 07, 2013 at 12:42:46PM +0800, Chen Gang wrote:
>
> The fields must be null-terminated, or simple_strtoul will cause issue.
>
> Signed-off-by: Chen Gang <[email protected]>
ACK
于 2013年01月07日 19:17, Stanislaw Gruszka 写道:
>> > Signed-off-by: Chen Gang <[email protected]>
> ACK
thank you very much.
:-)
--
Chen Gang
Flying Transformer