| Message ID | 1405994893-19649-1-git-send-email-computersforpeace@gmail.com |
|---|---|
| State | Accepted |
| Commit | 1cc8d8413327a684cd5e93cd52ececb0223bb40b |
| Headers | show |
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index a0f54e80670c..53563955931b 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -549,6 +549,9 @@ static int mtdchar_blkpg_ioctl(struct mtd_info *mtd, if (mtd_is_partition(mtd)) return -EINVAL; + /* Sanitize user input */ + p.devname[BLKPG_DEVNAMELTH - 1] = '\0'; + return mtd_add_partition(mtd, p.devname, p.start, p.length); case BLKPG_DEL_PARTITION:
Noticed by Coverity as a potential security issue. Signed-off-by: Brian Norris <computersforpeace@gmail.com> --- Untested for now. Maybe I'll scrape together a test before applying, then it'd be worth sending -stable. drivers/mtd/mtdchar.c | 3 +++ 1 file changed, 3 insertions(+)