mtd: terminate user-provided string

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=1cc8d8413327a684cd5e93cd52ececb0223bb40b
Commit:     1cc8d8413327a684cd5e93cd52ececb0223bb40b
Parent:     537ab1bd47d6518e8a40207a80dd0c2c4bc43aed
Author:     Brian Norris <computersforpeace at gmail.com>
AuthorDate: Mon Jul 21 19:08:13 2014 -0700
Committer:  Brian Norris <computersforpeace at gmail.com>
CommitDate: Tue Aug 19 11:53:09 2014 -0700

    mtd: terminate user-provided string
    
    Noticed by Coverity as a potential security issue.
    
    Signed-off-by: Brian Norris <computersforpeace at gmail.com>
---
 drivers/mtd/mtdchar.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index a0f54e8..5356395 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -549,6 +549,9 @@ static int mtdchar_blkpg_ioctl(struct mtd_info *mtd,
 		if (mtd_is_partition(mtd))
 			return -EINVAL;
 
+		/* Sanitize user input */
+		p.devname[BLKPG_DEVNAMELTH - 1] = '\0';
+
 		return mtd_add_partition(mtd, p.devname, p.start, p.length);
 
 	case BLKPG_DEL_PARTITION: