diff options
| author | Tomas Winkler | 2013-07-24 16:22:59 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2013-07-24 22:50:53 -0700 |
| commit | 8b613bb86a3d4a106c9a8f6de3d8a4c3628ea998 (patch) | |
| tree | 1fedee9ea5b7f72f5db444fdbce40ba9e0cc11a9 | |
| parent | 5290801c23231c8e192943d3beb01fdbeb536395 (diff) | |
mei: bus: do not overflow the device name buffer
1. use strncmp for comparsion strncpy was used for copying
which may omit the final %NUL terminator
2. id->name is statically defined so we can use sizeof
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/misc/mei/bus.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c index 9ecd49a7be1b..a150a42ed4af 100644 --- a/drivers/misc/mei/bus.c +++ b/drivers/misc/mei/bus.c @@ -47,7 +47,7 @@ static int mei_cl_device_match(struct device *dev, struct device_driver *drv) id = driver->id_table; while (id->name[0]) { - if (!strcmp(dev_name(dev), id->name)) + if (!strncmp(dev_name(dev), id->name, sizeof(id->name))) return 1; id++; @@ -71,7 +71,7 @@ static int mei_cl_device_probe(struct device *dev) dev_dbg(dev, "Device probe\n"); - strncpy(id.name, dev_name(dev), MEI_CL_NAME_SIZE); + strncpy(id.name, dev_name(dev), sizeof(id.name)); return driver->probe(device, &id); } |