integrity: add validity checks for 'path' parameter

This patch adds validity checks for 'path' parameter and
makes it const.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 5e3bd72b299ae5822490addbc3b4572fc5f0d739..36fb6b527829cead887c28828f9d3c83115568a7 100644 (file)
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -85,7 +85,7 @@ int __init integrity_init_keyring(const unsigned int id)
        return err;
 }
 
-int __init integrity_load_x509(const unsigned int id, char *path)
+int __init integrity_load_x509(const unsigned int id, const char *path)
 {
        key_ref_t key;
        char *data;

diff --git a/security/integrity/iint.c b/security/integrity/iint.c
index dbb6d141c3db4822fc4e836934bb03ab4da366bf..3d2f5b45c8cbeb0b376749adab00985b7a636f6f 100644 (file)
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -213,6 +213,9 @@ int __init integrity_read_file(const char *path, char **data)
        char *buf;
        int rc = -EINVAL;
 
+       if (!path || !*path)
+               return -EINVAL;
+
        file = filp_open(path, O_RDONLY, 0);
        if (IS_ERR(file)) {
                rc = PTR_ERR(file);

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 0fc9519fefa9ad937e4813f2a9271f0c81036c6d..9c6168709d3bc6957261bb6c17cefa64d8c4ffc5 100644 (file)
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -135,7 +135,7 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
                            const char *digest, int digestlen);
 
 int __init integrity_init_keyring(const unsigned int id);
-int __init integrity_load_x509(const unsigned int id, char *path);
+int __init integrity_load_x509(const unsigned int id, const char *path);
 #else
 
 static inline int integrity_digsig_verify(const unsigned int id,