For NUL terminated string, need always let it ended by zero.
The 'name' may be copied to user mode ('dvb_fe->ops.info' is 'struct
dvb_frontend_info' which is defined in ./include/uapi/...), and its
length is also known within as102_dvb_register_fe(), so need fully
initialize it (not use strlcpy instead of strncpy).
Signed-off-by: Chen Gang <[email protected]>
---
drivers/staging/media/as102/as102_fe.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/staging/media/as102/as102_fe.c
b/drivers/staging/media/as102/as102_fe.c
index 9ce8c9d..b3efec9 100644
--- a/drivers/staging/media/as102/as102_fe.c
+++ b/drivers/staging/media/as102/as102_fe.c
@@ -334,6 +334,7 @@ int as102_dvb_register_fe(struct as102_dev_t *as102_dev,
memcpy(&dvb_fe->ops, &as102_fe_ops, sizeof(struct dvb_frontend_ops));
strncpy(dvb_fe->ops.info.name, as102_dev->name,
sizeof(dvb_fe->ops.info.name));
+ dvb_fe->ops.info.name[sizeof(dvb_fe->ops.info.name) - 1] = '\0';
/* register dvb frontend */
errno = dvb_register_frontend(dvb_adap, dvb_fe);
--
1.7.7.6
_______________________________________________
devel mailing list
[email protected]
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
