[lkml]   [2010]   [Jul]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[patch] 9p: strlen() doesn't count the terminator
    This is an off by one bug because strlen() doesn't count the NULL
    terminator. We strcpy() addr into a fixed length array of size
    UNIX_PATH_MAX later on.

    The addr variable is the name of the device being mounted.

    Signed-off-by: Dan Carpenter <>

    diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
    index 98ce9bc..c85109d 100644
    --- a/net/9p/trans_fd.c
    +++ b/net/9p/trans_fd.c
    @@ -948,7 +948,7 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)

    csocket = NULL;

    - if (strlen(addr) > UNIX_PATH_MAX) {
    + if (strlen(addr) >= UNIX_PATH_MAX) {
    P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n",
    return -ENAMETOOLONG;

     \ /
      Last update: 2010-07-10 11:55    [W:0.018 / U:14.496 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site