commit 2d890a774b583ea47202e25284b74a1575e401fe
author Linux Build Service Account <lnxbuild@localhost> Thu Jan 09 20:16:59 2014 -0800
committer Gerrit - the friendly Code Review server <code-review@localhost> Thu Jan 09 20:16:57 2014 -0800
tree 76de3b4a29b5bfbfcbd59a82a860e3f9a3aec343
parent 5e8512e8c15b23d44203ada18970d67a000a51ed
parent 5a8faafd9854756cf69520a5f5876ab728de7d3a

Merge "msm: ipa: Fix the format string vulnerability."

drivers/platform/msm/ipa/ipa.c

diff --git a/drivers/platform/msm/ipa/ipa.c b/drivers/platform/msm/ipa/ipa.c
index 1ef1f1b..20603f5 100644
--- a/drivers/platform/msm/ipa/ipa.c
+++ b/drivers/platform/msm/ipa/ipa.c
@@ -205,6 +205,8 @@
 			retval = -EFAULT;
 			break;
 		}
+		/* null terminate the string */
+		nat_mem.dev_name[IPA_RESOURCE_NAME_MAX - 1] = '\0';
 
 		if (allocate_nat_device(&nat_mem)) {
 			retval = -EFAULT;

drivers/platform/msm/ipa/ipa_nat.c

diff --git a/drivers/platform/msm/ipa/ipa_nat.c b/drivers/platform/msm/ipa/ipa_nat.c
index e2c344f..6ee16fb 100644
--- a/drivers/platform/msm/ipa/ipa_nat.c
+++ b/drivers/platform/msm/ipa/ipa_nat.c
@@ -166,7 +166,7 @@
 
 	nat_ctx->dev =
 	   device_create(nat_ctx->class, NULL, nat_ctx->dev_num, nat_ctx,
-			 mem->dev_name);
+			"%s", mem->dev_name);
 
 	if (IS_ERR(nat_ctx->dev)) {
 		IPAERR("device_create err:%ld\n", PTR_ERR(nat_ctx->dev));