commit 66c65d90db1004356281db6ead988e2e38ba9e37
author Craig Markwardt Wed Jan 01 15:38:52 2014 +0000
committer Jonathan Cameron <jic23@kernel.org> Wed Jan 01 15:48:58 2014 +0000
tree 5f303f7f64af375931a93519da982c62f41caddf
parent e9ed104de68c345c9a827225e93c74c6894613a9

iio: Fix a buffer overflow in iio_utils.h example code

This was originally reported by Craig Markwardt on Zubair Lutfullah's
blog and Zubair forwarded it to linux-iio@vger.kernel.org. No email
address known.

The code first counted the number of enabled channels, then created an
array to hold information about them.  The code that filled this array then
stored whether a given element was enabled inside the array.  Curriously
this element was never used.  Craig's patch added a local temporary variable
to avoid the buffer overrun.  Jonathan then removed the original enabled
element of the structure as it was not needed at all.

Signed-off-by: Zubair Lutfullah <zubair.lutfullah@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>

drivers/staging/iio/Documentation/iio_utils.h

diff --git a/drivers/staging/iio/Documentation/iio_utils.h b/drivers/staging/iio/Documentation/iio_utils.h
index 35154d6..c9fedb7 100644
--- a/drivers/staging/iio/Documentation/iio_utils.h
+++ b/drivers/staging/iio/Documentation/iio_utils.h
@@ -77,7 +77,6 @@
 	uint64_t mask;
 	unsigned be;
 	unsigned is_signed;
-	unsigned enabled;
 	unsigned location;
 };
 
@@ -335,6 +334,7 @@
 	while (ent = readdir(dp), ent != NULL) {
 		if (strcmp(ent->d_name + strlen(ent->d_name) - strlen("_en"),
 			   "_en") == 0) {
+			int current_enabled = 0;
 			current = &(*ci_array)[count++];
 			ret = asprintf(&filename,
 				       "%s/%s", scan_el_dir, ent->d_name);
@@ -350,10 +350,10 @@
 				ret = -errno;
 				goto error_cleanup_array;
 			}
-			fscanf(sysfsfp, "%u", &current->enabled);
+			fscanf(sysfsfp, "%u", &current_enabled);
 			fclose(sysfsfp);
 
-			if (!current->enabled) {
+			if (!current_enabled) {
 				free(filename);
 				count--;
 				continue;