[PATCH RFC 14/38] um: NUL-terminate what is written to /proc/exitcode

[Christian Brauner]

exitcode_proc_write() copies up to sizeof(buf) bytes of the write into
buf and hands it to simple_strtol() without terminating it. So
"echo -n 5" parses whatever the stack held after the '5', and a write of
seven bytes or more reads past the end of buf. Terminate the copy.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: sta...@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brau...@kernel.org>
---
 arch/um/kernel/exitcode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/um/kernel/exitcode.c b/arch/um/kernel/exitcode.c
index 43edc2aa57e4..0230354f4812 100644
--- a/arch/um/kernel/exitcode.c
+++ b/arch/um/kernel/exitcode.c
@@ -43,9 +43,10 @@ static ssize_t exitcode_proc_write(struct file *file,
        size_t size;
        int tmp;
 
-       size = min(count, sizeof(buf));
+       size = min(count, sizeof(buf) - 1);
        if (copy_from_user(buf, buffer, size))
                return -EFAULT;
+       buf[size] = '\0';
 
        tmp = simple_strtol(buf, &end, 0);
        if ((*end != '\0') && !isspace(*end))

-- 
2.53.0