lkml.org 
[lkml]   [2016]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 307/342] sunrpc/cache: fix off-by-one in qword_get()
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Stefan Hajnoczi <stefanha@redhat.com>

    commit b7052cd7bcf3c1478796e93e3dff2b44c9e82943 upstream.

    The qword_get() function NUL-terminates its output buffer. If the input
    string is in hex format \xXXXX... and the same length as the output
    buffer, there is an off-by-one:

    int qword_get(char **bpp, char *dest, int bufsize)
    {
    ...
    while (len < bufsize) {
    ...
    *dest++ = (h << 4) | l;
    len++;
    }
    ...
    *dest = '\0';
    return len;
    }

    This patch ensures the NUL terminator doesn't fall outside the output
    buffer.

    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/sunrpc/cache.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/sunrpc/cache.c
    +++ b/net/sunrpc/cache.c
    @@ -1225,7 +1225,7 @@ int qword_get(char **bpp, char *dest, in
    if (bp[0] == '\\' && bp[1] == 'x') {
    /* HEX STRING */
    bp += 2;
    - while (len < bufsize) {
    + while (len < bufsize - 1) {
    int h, l;

    h = hex_to_bin(bp[0]);
    \
     
     \ /
      Last update: 2016-03-02 01:41    [W:4.066 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site