Replaced strcpy call with safer strscpy call with given length.
This elimates the need to manually null-terminate the given string,
since strscpy will null terminate the destination anyway.:
Signed-off-by: Ole Wiedemann <ole.wiedemann@fau.de>
Co-developed-by: Sebastian Scherbel <sebastian.scherbel@fau.de>
Signed-off-by: Sebastian Scherbel <sebastian.scherbel@fau.de>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20191213131032.22579-1-ole.wiedemann@fau.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
len = strncpy_from_user(local_name, name, ASHMEM_NAME_LEN);
if (len < 0)
return len;
- if (len == ASHMEM_NAME_LEN)
- local_name[ASHMEM_NAME_LEN - 1] = '\0';
+
mutex_lock(&ashmem_mutex);
/* cannot change an existing mapping's name */
if (asma->file)
ret = -EINVAL;
else
- strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name);
+ strscpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name,
+ ASHMEM_NAME_LEN);
mutex_unlock(&ashmem_mutex);
return ret;