parisc: memory overflow, 'name' length is too short for using
authorChen Gang <gang.chen@asianux.com>
Mon, 27 May 2013 04:57:09 +0000 (04:57 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 27 Jun 2013 17:38:42 +0000 (10:38 -0700)
commit8fd29ffeedc34861e5512c4cdc6a3c648880823d
tree34391a98f138f036188ef08561f577246d536d6b
parent02f52975eb0858eb03ca091f644c8eb171895f92
parisc: memory overflow, 'name' length is too short for using

commit 3f108de96ba449a8df3d7e3c053bf890fee2cb95 upstream.

'path.bc[i]' can be asigned by PCI_SLOT() which can '> 10', so sizeof(6
* "%u:" + "%u" + '\0') may be 21.

Since 'name' length is 20, it may be memory overflow.

And 'path.bc[i]' is 'unsigned char' for printing, we can be sure the
max length of 'name' must be less than 28.

So simplify thinking, we can use 28 instead of 20 directly, and do not
think of whether 'patchc.bc[i]' can '> 100'.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/parisc/kernel/drivers.c