Commit a29ae23f authored Jan 30, 2011 by Stefan Weil Committed by David S. Miller Feb 01, 2011

isdn: icn: Fix potentially wrong string handling



This warning was reported by cppcheck:
drivers/isdn/icn/icn.c:1641: error: Dangerous usage of 'rev' (strncpy doesn't always 0-terminate it)

If strncpy copied 20 bytes, the destination string rev was not terminated.
The patch adds one more byte to rev and makes sure that this byte is
always 0.

Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Tejun Heo <tj@kernel.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent d9c8f498

drivers/isdn/icn/icn.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1627,7 +1627,7 @@ __setup("icn=", icn_setup);
		static int __init icn_init(void)
		{
		char *p;
		char rev[20];
		char rev[21];

		memset(&dev, 0, sizeof(icn_dev));
		dev.memaddr = (membase & 0x0ffc000);
		@@ -1638,6 +1638,7 @@ static int __init icn_init(void)

		if ((p = strchr(revision, ':'))) {
		strncpy(rev, p + 1, 20);
		rev[20] = '\0';
		p = strchr(rev, '$');
		if (p)
		*p = 0;

Admin message