From: Marek Lindner Date: Sat, 27 Apr 2013 08:22:28 +0000 (+0800) Subject: batman-adv: check proto length before accessing proto string buffer X-Git-Tag: v3.10-rc2~34^2~15^2~3 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=293c9c1cef6be46ad72b528fa79c3ff034551fe0;p=platform%2Fkernel%2Flinux-exynos.git batman-adv: check proto length before accessing proto string buffer batadv_param_set_ra() strips the trailing '\n' from the supplied string buffer without checking the length of the buffer first. This patches avoids random memory access and associated potential crashes. Reported-by: Sasha Levin Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli --- diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index 3e30a0f..9c620cd 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp) char *algo_name = (char *)val; size_t name_len = strlen(algo_name); - if (algo_name[name_len - 1] == '\n') + if (name_len > 0 && algo_name[name_len - 1] == '\n') algo_name[name_len - 1] = '\0'; bat_algo_ops = batadv_algo_get(algo_name);