diff options
| author |   Jason A. Donenfeld <Jason@zx2c4.com> | 2012-04-02 21:13:41 +0200 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2012-04-02 21:13:41 +0200 |
| commit | 1c069ba52a38da15080a1b51b3accad6ae93c1cb (patch) | |
| tree | fe84ae591565288313d13396a27cdaea449c3686 | |
| parent | Simplify reading of port. (diff) | |
| download | android-connect-blinker-1c069ba52a38da15080a1b51b3accad6ae93c1cb.tar.xz android-connect-blinker-1c069ba52a38da15080a1b51b3accad6ae93c1cb.zip | |
Fix overflow.
| -rw-r--r-- | blinker.c | 5 |
1 files changed, 3 insertions, 2 deletions
@@ -88,10 +88,11 @@ int port_write(struct file *file, const char __user *ubuf, unsigned long count, char buf[MAX_LENGTH]; printk(KERN_INFO "blinker: called set_port\n"); memset(buf, 0, sizeof(buf)); - if (count > MAX_LENGTH) - count = MAX_LENGTH; + if (count > MAX_LENGTH - 1) + count = MAX_LENGTH - 1; if (copy_from_user(&buf, ubuf, count)) return -EFAULT; + buf[MAX_LENGTH - 1] = 0; sscanf(buf, "%u", &trigger_port); return count; } |