mtd: terminate user-provided string

Noticed by Coverity as a potential security issue.

Signed-off-by: Brian Norris <computersforpeace@gmail.com>

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index a0f54e80670cc85bda232a4cd1a00d14c9c47a6f..53563955931b4e2bb20acd576fadb3cfde8a4085 100644 (file)
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -549,6 +549,9 @@ static int mtdchar_blkpg_ioctl(struct mtd_info *mtd,
                if (mtd_is_partition(mtd))
                        return -EINVAL;
 
+               /* Sanitize user input */
+               p.devname[BLKPG_DEVNAMELTH - 1] = '\0';
+
                return mtd_add_partition(mtd, p.devname, p.start, p.length);
 
        case BLKPG_DEL_PARTITION: