Messages in this thread | | | From | Kevin Corry <> | Subject | Re: [PATCH 3/8] dm: prevent possible buffer overflow in ioctl interface | Date | Fri, 28 Feb 2003 12:31:27 -0600 |
| |
On Friday 28 February 2003 12:14, Horst von Brand wrote: > Kevin Corry <corryk@us.ibm.com> said: > > Also, the "+1" is still necessary, even if we switch to sizeof. The > > sprintf call that follows copies DM_DIR, followed by a slash, followed by > > the name from the hash table into the allocated string. The "+1" is for > > the slash in the middle. The terminating NULL character is accounted for > > in > > DM_NAME_LEN. > > Then it was broken before. > > sizeof("1234") == strlen("1234") + 1 == 5
Hmmm...wasn't aware of that. I guess I never expected there to be a difference. If that's the case, then Joe Perches' earlier patch should do the trick, albiet for obscure reasons.
And I wouldn't say it was broken the other way; it was simply allocating one byte more than necessary.
-- Kevin Corry corryk@us.ibm.com http://evms.sourceforge.net/ - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |