Messages in this thread | | | Subject | Re: [patch] vga_switcheroo: comparing too few characters in strncmp() | From | Mailing Lists <> | Date | Thu, 06 Jan 2011 23:07:22 -0700 |
| |
On Fri, 2011-01-07 at 07:30 +0200, Alexey Dobriyan wrote: > On Fri, Jan 07, 2011 at 08:12:27AM +0300, Dan Carpenter wrote: > > This is a copy-and-paste bug. We should be comparing 4 characters here > > instead of 3. > > > --- a/drivers/gpu/vga/vga_switcheroo.c > > +++ b/drivers/gpu/vga/vga_switcheroo.c > > @@ -346,11 +346,11 @@ vga_switcheroo_debugfs_write(struct file *filp, const char __user *ubuf, > > if (strncmp(usercmd, "DIS", 3) == 0) > > client_id = VGA_SWITCHEROO_DIS; > > > > - if (strncmp(usercmd, "MIGD", 3) == 0) { > > + if (strncmp(usercmd, "MIGD", 4) == 0) { > > just_mux = true; > > client_id = VGA_SWITCHEROO_IGD; > > } > > - if (strncmp(usercmd, "MDIS", 3) == 0) { > > + if (strncmp(usercmd, "MDIS", 4) == 0) { > > How about you NUL-terminate, and use strcmp().
Userspace data? How to guarantee NULL terminated string at runtime?
Still, the string constants being compared against are already NULL terminated, so he could use strcmp as is.
Also, strcmp() would discard user strings that start with a matching substring ("DIS", "DISK", "DISH", "DISINTERESTED" would all set client_id to VGA_SWITCHEROO_DIS, using strncmp(), but strcmp() would only match "DIS").
> -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/
| |