From: Brian Norris <computersforpeace@gmail.com>
Date: Tue, 22 Jul 2014 02:08:13 +0000 (-0700)
Subject: mtd: terminate user-provided string
X-Git-Tag: firefly_0821_release~176^2~2922^2~38^2~5
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=1cc8d8413327a684cd5e93cd52ececb0223bb40b;p=firefly-linux-kernel-4.4.55.git

mtd: terminate user-provided string

Noticed by Coverity as a potential security issue.

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
---

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index a0f54e80670c..53563955931b 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -549,6 +549,9 @@ static int mtdchar_blkpg_ioctl(struct mtd_info *mtd,
 		if (mtd_is_partition(mtd))
 			return -EINVAL;
 
+		/* Sanitize user input */
+		p.devname[BLKPG_DEVNAMELTH - 1] = '\0';
+
 		return mtd_add_partition(mtd, p.devname, p.start, p.length);
 
 	case BLKPG_DEL_PARTITION: