From bed3b10d20e34683ddc596f7858fef076d148390 Mon Sep 17 00:00:00 2001 From: Ken Cox Date: Fri, 7 Mar 2014 10:30:27 -0600 Subject: [PATCH] Staging: unisys: virthba: Fix variable length array A character array was declared on the stack with variable length. This has been corrected to use a fixed length. Reported-by: Dan Carpenter Signed-off-by: Ken Cox Signed-off-by: Greg Kroah-Hartman --- drivers/staging/unisys/virthba/virthba.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/staging/unisys/virthba/virthba.c b/drivers/staging/unisys/virthba/virthba.c index c292293718f0..277851fff443 100644 --- a/drivers/staging/unisys/virthba/virthba.c +++ b/drivers/staging/unisys/virthba/virthba.c @@ -1439,12 +1439,15 @@ static ssize_t enable_ints_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos) { - char buf[count + 1]; + char buf[4]; int i, new_value; struct virthba_info *virthbainfo; U64 *Features_addr; U64 mask; + if (count >= ARRAY_SIZE(buf)) + return -EINVAL; + buf[count] = '\0'; if (copy_from_user(buf, buffer, count)) { LOGERR("copy_from_user failed. buf<<%.*s>> count<<%lu>>\n", -- 2.20.1