• Geert Uytterhoeven's avatar
    spi: spidev_test: Fix buffer overflow in unescape() · 0278b34b
    Geert Uytterhoeven authored
    Sometimes spidev_test crashes with:
    
        *** Error in `spidev_test': munmap_chunk(): invalid pointer: 0x00022020 ***
        Aborted
    
    or just
    
        Segmentation fault
    
    This is due to transfer_escaped_string() miscalculating the required
    size of the buffer by one byte, causing a buffer overflow in unescape().
    
    Drop the bogus "+ 1" in the strlen() parameter to fix this.
    
    Note that unescape() never copies the zero-terminator of the source
    string, so it writes at most as many bytes as the length of the source
    string.
    
    Fixes: 30061915 (spi: spidev_test: Added input buffer from the terminal)
    Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: default avatarMark Brown <broonie@kernel.org>
    Cc: <stable@vger.kernel.org> # v4.5+
    0278b34b
spidev_test.c 8.29 KB