staging: usbip: fix potential segfault because of unchecked return value of strchr.
authorChristopher Harvey <charvey@matrox.com>
Fri, 23 Mar 2012 14:55:25 +0000 (10:55 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 10 Apr 2012 16:47:06 +0000 (09:47 -0700)
This doesn't happen with the usbip virtual hci module, but another
module wanting to interface with this user space code could cause a
seg-fault by sending data without newlines.

Signed-off-by: Christopher Harvey <charvey@matrox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/usbip/userspace/libsrc/vhci_driver.c

index 269787751b208170208c653ffd9ef14a3fe5935c..0958ba53e94ad77e50a840c1785c73c336b5b01d 100644 (file)
@@ -59,7 +59,10 @@ static int parse_status(char *value)
 
 
        /* skip a header line */
-       c = strchr(value, '\n') + 1;
+       c = strchr(value, '\n');
+       if (!c)
+               return -1;
+       c++;
 
        while (*c != '\0') {
                int port, status, speed, devid;
@@ -109,7 +112,10 @@ static int parse_status(char *value)
 
 
                /* go to the next line */
-               c = strchr(c, '\n') + 1;
+               c = strchr(c, '\n');
+               if (!c)
+                       break;
+               c++;
        }
 
        dbg("exit");
@@ -264,11 +270,17 @@ static int get_nports(void)
            attr_status->method, attr_status->value);
 
        /* skip a header line */
-       c = strchr(attr_status->value, '\n') + 1;
+       c = strchr(attr_status->value, '\n');
+       if (!c)
+               return 0;
+       c++;
 
        while (*c != '\0') {
                /* go to the next line */
-               c = strchr(c, '\n') + 1;
+               c = strchr(c, '\n');
+               if (!c)
+                       return nports;
+               c++;
                nports += 1;
        }