debugfs: write_file_bool() - ensure strtobool() operates on valid data
authorMathias Krause <minipli@googlemail.com>
Fri, 31 May 2013 21:24:29 +0000 (23:24 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 3 Jun 2013 20:55:02 +0000 (13:55 -0700)
In case, userland writes an empty string to a bool debugfs file, buf[]
will still be uninitialized when being passed to strtobool() making the
outcome of that function purely random.

Fix this by always zero-terminating the buffer.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/debugfs/file.c

index ff64bcd..6314629 100644 (file)
@@ -473,6 +473,7 @@ static ssize_t write_file_bool(struct file *file, const char __user *user_buf,
        if (copy_from_user(buf, user_buf, buf_size))
                return -EFAULT;
 
+       buf[buf_size] = '\0';
        if (strtobool(buf, &bv) == 0)
                *val = bv;