shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 10:31:46 +09:00
Code Issues Packages Projects Releases Wiki Activity

ANDROID: mm/memfd-ashmem-shim: Fix variable length array usage

Browse Source 
The size of the buffer used to retrieve the memfd file name is
currently calculated at runtime, making the buffer a variable
length array. However, all of the terms used in the buffer size
calculation are known at compile time, so use compile time constants
for the calculation.

Bug: 399839316
Change-Id: Ie1edf9a28f735ebeffab07f64efc4de45f1f095a
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
This commit is contained in:
Isaac J. Manjarres
2025-02-28 10:40:40 -08:00
committed by Treehugger Robot
parent 6b227a1f74
commit 471a10d3af
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mm/memfd-ashmem-shim.c
View File

@@ -17,10 +17,12 @@
#include "memfd-ashmem-shim-internal.h"
/* file_path() returns the path of the file including the root, hence the additional "/". */
#define MEMFD_PATH_PREFIX_LEN strlen("/memfd:")
#define MEMFD_PATH_PREFIX "/memfd:"
#define MEMFD_PATH_PREFIX_LEN (sizeof(MEMFD_PATH_PREFIX) - 1)
/* All memfd files are unlinked, and are therefore suffixed with the " (deleted)" string. */
#define UNLINKED_FILE_SUFFIX_LEN strlen(" (deleted)")
#define UNLINKED_FILE_SUFFIX " (deleted)"
#define UNLINKED_FILE_SUFFIX_LEN (sizeof(UNLINKED_FILE_SUFFIX) - 1)
/*
* 1 character for the start of the path (/), NAME_MAX for the maximum length of a full memfd file
@@ -38,8 +40,8 @@ static char *get_memfd_file_name(struct file *file, char *buf, size_t size)
return path;
/* Only handle memfds; we cannot make assumptions about other file names. */
name_end = strstr(path, " (deleted)");
if ((strstr(path, "/memfd:") != path) || !name_end)
name_end = strstr(path, UNLINKED_FILE_SUFFIX);
if ((strstr(path, MEMFD_PATH_PREFIX) != path) || !name_end)
return ERR_PTR(-EINVAL);
/*