Skip to content

Commit

Permalink
vfm: string without null-termination [1/1]
Browse files Browse the repository at this point in the history 
PD#OTT-4743

Problem:
string withou null-termination

Solution:
ensure there is a null-termination in the string

Verify:
p212

Change-Id: Icfb6e39741b5d26611bbd316d6c423b8d4715105
Signed-off-by: apollo.ling <apollo.ling@amlogic.com>
  • Loading branch information
@codewalkerster
apollo.ling authored and codewalkerster committed Aug 29, 2019
1 parent 6dd0b7c commit 7fc81e1
Showing 1 changed file with 10 additions and 9 deletions.
19 changes: 10 additions & 9 deletions drivers/amlogic/media/common/vfm/vfm.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -738,17 +738,19 @@ static long vfm_ioctl(struct file *file, unsigned int cmd, ulong arg)
struct vfmctl *user_argp = (void __user *)arg;
struct vfmctl argp;

memset(&argp, 0, sizeof(struct vfmctl));

switch (cmd) {
case VFM_IOCTL_CMD_SET:{
ret =
copy_from_user(argp.name, user_argp->name, sizeof(argp.name));
copy_from_user(argp.name, user_argp->name, sizeof(argp.name)-1);
ret |=
copy_from_user(argp.val, user_argp->val, sizeof(argp.val));
copy_from_user(argp.val, user_argp->val, sizeof(argp.val) - 1);
if (ret)
ret = -EINVAL;
else
ret =
vfm_map_store(NULL, NULL, argp.val, sizeof(argp.val));
vfm_map_store(NULL, NULL, argp.val, sizeof(argp.val) - 1);
}
break;
case VFM_IOCTL_CMD_GET:{
Expand All @@ -765,9 +767,9 @@ static long vfm_ioctl(struct file *file, unsigned int cmd, ulong arg)
break;
case VFM_IOCTL_CMD_ADD:{
ret =
copy_from_user(argp.name, user_argp->name, sizeof(argp.name));
copy_from_user(argp.name, user_argp->name, sizeof(argp.name)-1);
ret |=
copy_from_user(argp.val, user_argp->val, sizeof(argp.val));
copy_from_user(argp.val, user_argp->val, sizeof(argp.val) - 1);
if (ret)
ret = -EINVAL;
else
Expand All @@ -776,7 +778,7 @@ static long vfm_ioctl(struct file *file, unsigned int cmd, ulong arg)
break;
case VFM_IOCTL_CMD_RM:{
ret =
copy_from_user(argp.val, user_argp->val, sizeof(argp.val));
copy_from_user(argp.val, user_argp->val, sizeof(argp.val) - 1);
if (ret)
ret = -EINVAL;
else
Expand All @@ -785,16 +787,15 @@ static long vfm_ioctl(struct file *file, unsigned int cmd, ulong arg)
break;
case VFM_IOCTL_CMD_DUMP:{
ret =
copy_from_user(argp.val, user_argp->val, sizeof(argp.val));
copy_from_user(argp.val, user_argp->val, sizeof(argp.val) - 1);
if (ret)
ret = -EINVAL;
argp.val[sizeof(argp.val) - 1] = '\0';
vfm_dump_provider(argp.val);
}
break;
case VFM_IOCTL_CMD_ADDDUMMY:{
ret =
copy_from_user(argp.val, user_argp->val, sizeof(argp.val));
copy_from_user(argp.val, user_argp->val, sizeof(argp.val) - 1);
if (ret)
ret = -EINVAL;
add_dummy_receiver(argp.val);
Expand Down

0 comments on commit 7fc81e1

Please sign in to comment.