Title: [9688] trunk/drivers/staging/iio/Documentation/iio_utils.h: merge from upstream: IIO: Documentation: iio_utils: Prevent buffer overflow
- Revision
- 9688
- Author
- vapier
- Date
- 2011-03-01 16:18:49 -0500 (Tue, 01 Mar 2011)
Log Message
merge from upstream: IIO: Documentation: iio_utils: Prevent buffer overflow
From: Michael Hennerich <[email protected]>
The first part of build_channel_array()identifies the number of enabled channels.
Further down this count is used to allocate the ci_array. The next section parses the
scan_elements directory again, and fills ci_array regardless if the channel is enabled or not.
So if less than available channels are enabled ci_array memory is overflowed.
This fix makes sure that we allocate enough memory. But the whole approach looks a bit
cumbersome to me. Why not allocate memory for MAX_CHANNLES, less say 64
(I never seen a part with more than that channels). And skip the first part entirely.
Signed-off-by: Michael Hennerich <[email protected]>
Acked-by: Jonathan Cameron <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Modified Paths
Diff
Modified: trunk/drivers/staging/iio/Documentation/iio_utils.h (9687 => 9688)
--- trunk/drivers/staging/iio/Documentation/iio_utils.h 2011-03-01 21:18:45 UTC (rev 9687)
+++ trunk/drivers/staging/iio/Documentation/iio_utils.h 2011-03-01 21:18:49 UTC (rev 9688)
@@ -290,15 +290,17 @@
fscanf(sysfsfp, "%u", &ret);
if (ret == 1)
(*counter)++;
+ count++;
fclose(sysfsfp);
free(filename);
}
- *ci_array = malloc(sizeof(**ci_array)*(*counter));
+ *ci_array = malloc(sizeof(**ci_array)*count);
if (*ci_array == NULL) {
ret = -ENOMEM;
goto error_close_dir;
}
seekdir(dp, 0);
+ count = 0;
while (ent = readdir(dp), ent != NULL) {
if (strcmp(ent->d_name + strlen(ent->d_name) - strlen("_en"),
"_en") == 0) {
_______________________________________________
Linux-kernel-commits mailing list
[email protected]
https://blackfin.uclinux.org/mailman/listinfo/linux-kernel-commits
