]> git.baikalelectronics.ru Git - kernel.git/commit
spi: spidev_test: Fix buffer overflow in unescape()
authorGeert Uytterhoeven <geert+renesas@glider.be>
Fri, 9 Sep 2016 07:02:51 +0000 (09:02 +0200)
committerMark Brown <broonie@kernel.org>
Wed, 14 Sep 2016 15:22:43 +0000 (16:22 +0100)
commitcc9b2f9034a4ef9723bcd4a318b3228521c32187
tree9fc3af0ff0d3401ea0d65e0b69e55b6fafd4aa08
parentb482605f7939bd4035b2d11a7952dc3da5821c6d
spi: spidev_test: Fix buffer overflow in unescape()

Sometimes spidev_test crashes with:

    *** Error in `spidev_test': munmap_chunk(): invalid pointer: 0x00022020 ***
    Aborted

or just

    Segmentation fault

This is due to transfer_escaped_string() miscalculating the required
size of the buffer by one byte, causing a buffer overflow in unescape().

Drop the bogus "+ 1" in the strlen() parameter to fix this.

Note that unescape() never copies the zero-terminator of the source
string, so it writes at most as many bytes as the length of the source
string.

Fixes: 2fc2a2635c6c6185 (spi: spidev_test: Added input buffer from the terminal)
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: <stable@vger.kernel.org> # v4.5+
tools/spi/spidev_test.c