lkml.org 
[lkml]   [2016]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.16.y-ckt 040/142] sunrpc/cache: fix off-by-one in qword_get()
    Date
    3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Stefan Hajnoczi <stefanha@redhat.com>

    commit b7052cd7bcf3c1478796e93e3dff2b44c9e82943 upstream.

    The qword_get() function NUL-terminates its output buffer. If the input
    string is in hex format \xXXXX... and the same length as the output
    buffer, there is an off-by-one:

    int qword_get(char **bpp, char *dest, int bufsize)
    {
    ...
    while (len < bufsize) {
    ...
    *dest++ = (h << 4) | l;
    len++;
    }
    ...
    *dest = '\0';
    return len;
    }

    This patch ensures the NUL terminator doesn't fall outside the output
    buffer.

    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    net/sunrpc/cache.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
    index 48f14003af10..14d38ec5e53d 100644
    --- a/net/sunrpc/cache.c
    +++ b/net/sunrpc/cache.c
    @@ -1230,7 +1230,7 @@ int qword_get(char **bpp, char *dest, int bufsize)
    if (bp[0] == '\\' && bp[1] == 'x') {
    /* HEX STRING */
    bp += 2;
    - while (len < bufsize) {
    + while (len < bufsize - 1) {
    int h, l;

    h = hex_to_bin(bp[0]);
    \
     
     \ /
      Last update: 2016-03-22 13:01    [W:3.231 / U:0.308 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site