Skip to content

Commit

Permalink
drivers/char/tpm/tpm_ppi: use strlcpy instead of strncpy
Browse files Browse the repository at this point in the history
 Ensure that the 'version' string includes a NULL terminator after its
copied out of the acpi table.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
  • Loading branch information
Chen Gang authored and Kent Yoder committed Apr 12, 2013
1 parent 2d089f8 commit e361200
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions drivers/char/tpm/tpm_ppi.c
Original file line number Diff line number Diff line change
Expand Up @@ -158,9 +158,9 @@ static ssize_t tpm_store_ppi_request(struct device *dev,
ACPI_TYPE_STRING);
if (ACPI_FAILURE(status))
return -ENOMEM;
strncpy(version,
strlcpy(version,
((union acpi_object *)output.pointer)->string.pointer,
PPI_VERSION_LEN);
PPI_VERSION_LEN + 1);
kfree(output.pointer);
output.length = ACPI_ALLOCATE_BUFFER;
output.pointer = NULL;
Expand Down Expand Up @@ -237,9 +237,9 @@ static ssize_t tpm_show_ppi_transition_action(struct device *dev,
ACPI_TYPE_STRING);
if (ACPI_FAILURE(status))
return -ENOMEM;
strncpy(version,
strlcpy(version,
((union acpi_object *)output.pointer)->string.pointer,
PPI_VERSION_LEN);
PPI_VERSION_LEN + 1);
/*
* PPI spec defines params[3].type as empty package, but some platforms
* (e.g. Capella with PPI 1.0) need integer/string/buffer type, so for
Expand Down Expand Up @@ -351,7 +351,7 @@ static ssize_t tpm_show_ppi_response(struct device *dev,
static ssize_t show_ppi_operations(char *buf, u32 start, u32 end)
{
char *str = buf;
char version[PPI_VERSION_LEN];
char version[PPI_VERSION_LEN + 1];
acpi_handle handle;
acpi_status status;
struct acpi_object_list input;
Expand Down Expand Up @@ -381,9 +381,9 @@ static ssize_t show_ppi_operations(char *buf, u32 start, u32 end)
if (ACPI_FAILURE(status))
return -ENOMEM;

strncpy(version,
strlcpy(version,
((union acpi_object *)output.pointer)->string.pointer,
PPI_VERSION_LEN);
PPI_VERSION_LEN + 1);
kfree(output.pointer);
output.length = ACPI_ALLOCATE_BUFFER;
output.pointer = NULL;
Expand Down

0 comments on commit e361200

Please sign in to comment.