summaryrefslogtreecommitdiff
path: root/fs/debugfs/file.c
diff options
context:
space:
mode:
authorMathias Krause <minipli@googlemail.com>2013-06-01 01:24:29 +0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-06-04 00:55:02 +0400
commita3b2c8c7aa1ca860edcf0b0afa371d9eb2269c3c (patch)
tree45f73dde89f44a0dd67e26859effd3cbe90286d8 /fs/debugfs/file.c
parent3a76e5e09fbb51e756b4e732e3e65446f4984cf5 (diff)
downloadlinux-a3b2c8c7aa1ca860edcf0b0afa371d9eb2269c3c.tar.xz
debugfs: write_file_bool() - ensure strtobool() operates on valid data
In case, userland writes an empty string to a bool debugfs file, buf[] will still be uninitialized when being passed to strtobool() making the outcome of that function purely random. Fix this by always zero-terminating the buffer. Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/debugfs/file.c')
-rw-r--r--fs/debugfs/file.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index ff64bcd5b8fb..63146295153b 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -473,6 +473,7 @@ static ssize_t write_file_bool(struct file *file, const char __user *user_buf,
if (copy_from_user(buf, user_buf, buf_size))
return -EFAULT;
+ buf[buf_size] = '\0';
if (strtobool(buf, &bv) == 0)
*val = bv;