Messages in this thread Patch in this message | | | Date | Mon, 28 Mar 2005 17:39:38 +0900 (JST) | Subject | Re: Off-by-one bug at unix_mkname ? | From | YOSHIFUJI Hideaki / 吉藤英明 <> |
| |
In article <20050328.172108.30349253.yoshfuji@linux-ipv6.org> (at Mon, 28 Mar 2005 17:21:08 +0900 (JST)), YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org> says:
> > It seems to me that the following code is off-by-one bug. : > Well, 2.2 has some comment on this:
So, I'd suggest to put the comment back to 2.4/2.6 instead. (Note: net/socket.c refers this around MAX_SOCK_ADDR definition.)
Signed-off-by: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
===== net/unix/af_unix.c 1.73 vs edited ===== --- 1.73/net/unix/af_unix.c 2005-03-10 13:42:53 +09:00 +++ edited/net/unix/af_unix.c 2005-03-28 17:31:33 +09:00 @@ -188,6 +188,15 @@ if (!sunaddr || sunaddr->sun_family != AF_UNIX) return -EINVAL; if (sunaddr->sun_path[0]) { + /* + * This may look like an off by one error but it is + * a bit more subtle. 108 is the longest valid AF_UNIX + * path for a binding. sun_path[108] doesnt as such + * exist. However in kernel space we are guaranteed that + * it is a valid memory location in our kernel + * address buffer. + */ + if (len > sizeof(*sunaddr)) ((char *)sunaddr)[len]=0; len = strlen(sunaddr->sun_path)+1+sizeof(short); return len; -- Hideaki YOSHIFUJI @ USAGI Project <yoshfuji@linux-ipv6.org> GPG FP: 9022 65EB 1ECF 3AD1 0BDF 80D8 4807 F894 E062 0EEA - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |