@@ -528,8 +528,9 @@ u32 MGRWRAP_RegisterObject(union Trapped_Args *args)
cp_fm_usr(&pUuid, args->ARGS_MGR_REGISTEROBJECT.pUuid, status, 1);
if (DSP_FAILED(status))
goto func_end;
+ /* pathSize is increased by 1 to accommodate NULL */
pathSize = strlen_user((char *)
- args->ARGS_MGR_REGISTEROBJECT.pszPathName);
+ args->ARGS_MGR_REGISTEROBJECT.pszPathName) + 1;
pszPathName = MEM_Alloc(pathSize, MEM_NONPAGED);
if (!pszPathName)
goto func_end;
@@ -540,7 +541,6 @@ u32 MGRWRAP_RegisterObject(union Trapped_Args *args)
status = DSP_EPOINTER;
goto func_end;
}
- pszPathName[pathSize] = '\0';
GT_1trace(WCD_debugMask, GT_ENTER,
"MGRWRAP_RegisterObject: entered pg2hMsg "
@@ -900,7 +900,8 @@ u32 PROCWRAP_Load(union Trapped_Args *args)
if (argv[i] != NULL) {
/* User space pointer to argument */
temp = (char *) argv[i];
- len = strlen_user((char *)temp);
+ /* len is increased by 1 to accommodate NULL */
+ len = strlen_user((char *)temp) + 1;
/* Kernel space pointer to argument */
argv[i] = MEM_Alloc(len, MEM_NONPAGED);
if (argv[i] == NULL) {
@@ -910,7 +911,6 @@ u32 PROCWRAP_Load(union Trapped_Args *args)
cp_fm_usr(argv[i], temp, status, len);
if (DSP_FAILED(status))
goto func_cont;
-
}
}
/* TODO: validate this */
@@ -933,7 +933,8 @@ u32 PROCWRAP_Load(union Trapped_Args *args)
for (i = 0; DSP_SUCCEEDED(status) && (envp[i] != NULL); i++) {
/* User space pointer to argument */
temp = (char *)envp[i];
- len = strlen_user((char *)temp);
+ /* len is increased by 1 to accommodate NULL */
+ len = strlen_user((char *)temp) + 1;
/* Kernel space pointer to argument */
envp[i] = MEM_Alloc(len, MEM_NONPAGED);
if (envp[i] == NULL) {