Staging: unisys: virthba: Fix variable length array

A character array was declared on the stack with variable length.  This has
been corrected to use a fixed length.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ken Cox <jkc@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/unisys/virthba/virthba.c b/drivers/staging/unisys/virthba/virthba.c
index c292293718f0b420c141a8236dd789b82c085a2c..277851fff443e809cadc0f3bc1e294eb2dc31e7a 100644 (file)
--- a/drivers/staging/unisys/virthba/virthba.c
+++ b/drivers/staging/unisys/virthba/virthba.c
@@ -1439,12 +1439,15 @@ static ssize_t
 enable_ints_write(struct file *file, const char __user *buffer,
                  size_t count, loff_t *ppos)
 {
-       char buf[count + 1];
+       char buf[4];
        int i, new_value;
        struct virthba_info *virthbainfo;
        U64 *Features_addr;
        U64 mask;
 
+       if (count >= ARRAY_SIZE(buf))
+               return -EINVAL;
+
        buf[count] = '\0';
        if (copy_from_user(buf, buffer, count)) {
                LOGERR("copy_from_user failed. buf<<%.*s>> count<<%lu>>\n",