Commit 8297ca5e authored Dec 13, 2019 by Ole Wiedemann Committed by Greg Kroah-Hartman Jan 14, 2020

staging: android: ashmem: Replace strcpy with strscpy



Replaced strcpy call with safer strscpy call with given length.
This elimates the need to manually null-terminate the given string,
since strscpy will null terminate the destination anyway.:

Signed-off-by: Ole Wiedemann <ole.wiedemann@fau.de>
Co-developed-by: Sebastian Scherbel <sebastian.scherbel@fau.de>
Signed-off-by: Sebastian Scherbel <sebastian.scherbel@fau.de>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20191213131032.22579-1-ole.wiedemann@fau.de


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent cdb9c044

drivers/staging/android/ashmem.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -537,14 +537,14 @@ static int set_name(struct ashmem_area asma, void __user name)
		len = strncpy_from_user(local_name, name, ASHMEM_NAME_LEN);
		if (len < 0)
		return len;
		if (len == ASHMEM_NAME_LEN)
		local_name[ASHMEM_NAME_LEN - 1] = '\0';

		mutex_lock(&ashmem_mutex);
		/* cannot change an existing mapping's name */
		if (asma->file)
		ret = -EINVAL;
		else
		strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name);
		strscpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name,
		ASHMEM_NAME_LEN);

		mutex_unlock(&ashmem_mutex);
		return ret;

Admin message