@@ -438,15 +438,24 @@ static int extract_package(struct acpi_battery *battery,
if (offsets[i].mode) {
u8 *ptr = (u8 *)battery + offsets[i].offset;
- if (element->type == ACPI_TYPE_STRING ||
- element->type == ACPI_TYPE_BUFFER)
+ switch (element->type) {
+ case ACPI_TYPE_STRING:
strscpy(ptr, element->string.pointer, 32);
- else if (element->type == ACPI_TYPE_INTEGER) {
- strncpy(ptr, (u8 *)&element->integer.value,
- sizeof(u64));
+
+ break;
+ case ACPI_TYPE_BUFFER:
+ strscpy(ptr, element->buffer.pointer,
+ min_t(u32, element->buffer.length + 1, 32));
+
+ break;
+ case ACPI_TYPE_INTEGER:
+ strncpy(ptr, (u8 *)&element->integer.value, sizeof(u64));
ptr[sizeof(u64)] = 0;
- } else
- *ptr = 0; /* don't have value */
+
+ break;
+ default:
+ *ptr = '\0'; /* don't have value */
+ }
} else {
int *x = (int *)((u8 *)battery + offsets[i].offset);
*x = (element->type == ACPI_TYPE_INTEGER) ?
If the buffer containing string data is not NUL-terminated (which is perfectly legal according to the ACPI specification), the acpi battery driver might not honor its length. Fix this by limiting the amount of data to be copied to the buffer length while also using strscpy() to make sure that the resulting string is always NUL-terminated. Also use '\0' instead of a plain 0. Signed-off-by: Armin Wolf <W_Armin@gmx.de> --- drivers/acpi/battery.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) -- 2.30.2