staging: android: ashmem: Replace strcpy with strscpy

Replaced strcpy call with safer strscpy call with given length.
This elimates the need to manually null-terminate the given string,
since strscpy will null terminate the destination anyway.:

Signed-off-by: Ole Wiedemann <ole.wiedemann@fau.de>
Co-developed-by: Sebastian Scherbel <sebastian.scherbel@fau.de>
Signed-off-by: Sebastian Scherbel <sebastian.scherbel@fau.de>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20191213131032.22579-1-ole.wiedemann@fau.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 74d497d..5891d07 100644 (file)
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -537,14 +537,14 @@ static int set_name(struct ashmem_area *asma, void __user *name)
        len = strncpy_from_user(local_name, name, ASHMEM_NAME_LEN);
        if (len < 0)
                return len;
-       if (len == ASHMEM_NAME_LEN)
-               local_name[ASHMEM_NAME_LEN - 1] = '\0';
+
        mutex_lock(&ashmem_mutex);
        /* cannot change an existing mapping's name */
        if (asma->file)
                ret = -EINVAL;
        else
-               strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name);
+               strscpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name,
+                       ASHMEM_NAME_LEN);
 
        mutex_unlock(&ashmem_mutex);
        return ret;