From a29ae23f687649c35b1520a8f986497637a0cc62 Mon Sep 17 00:00:00 2001 From: Stefan Weil Date: Sun, 30 Jan 2011 10:31:26 +0000 Subject: isdn: icn: Fix potentially wrong string handling This warning was reported by cppcheck: drivers/isdn/icn/icn.c:1641: error: Dangerous usage of 'rev' (strncpy doesn't always 0-terminate it) If strncpy copied 20 bytes, the destination string rev was not terminated. The patch adds one more byte to rev and makes sure that this byte is always 0. Cc: Karsten Keil Cc: "David S. Miller" Cc: Tejun Heo Cc: Steven Rostedt Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Weil Signed-off-by: David S. Miller --- drivers/isdn/icn/icn.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c index f2b5bab5e6a1..1f355bb85e54 100644 --- a/drivers/isdn/icn/icn.c +++ b/drivers/isdn/icn/icn.c @@ -1627,7 +1627,7 @@ __setup("icn=", icn_setup); static int __init icn_init(void) { char *p; - char rev[20]; + char rev[21]; memset(&dev, 0, sizeof(icn_dev)); dev.memaddr = (membase & 0x0ffc000); @@ -1638,6 +1638,7 @@ static int __init icn_init(void) if ((p = strchr(revision, ':'))) { strncpy(rev, p + 1, 20); + rev[20] = '\0'; p = strchr(rev, '$'); if (p) *p = 0; -- cgit v1.2.3