Messages in this thread | | | Subject | Re: [PATCH] nfs client, kernel 2.4.31: readlink result overflow | From | Valdis.Kletnieks@vt ... | Date | Mon, 12 Sep 2005 16:01:46 -0400 |
| |
On Mon, 12 Sep 2005 15:37:46 EDT, Assar said: > Valdis.Kletnieks@vt.edu writes: > > Odd, as it has similar code - 2.6.13-mm1 nfs2xdr.c has: > > /* Convert length of symlink */ > > len = ntohl(*p++); > > if (len >= rcvbuf->page_len || len <= 0) { > > To my reading, the 2.6.13 code does not copy the 4 bytes of length to > rcvbuf.
Hmm... it still does this: kaddr[len+rcvbuf->page_base] = '\0'; which still has a possible off-by-one? (Was that why you have -1 -4?)
> > Am I the only one who finds an uncommented "-1 -4" construct scary beyond belief? > > Probably not. What do you think looks better? sizeof(u32) ?
sizeof(actual_var) is even better, as that way it's clear what you're allowing space for.
[unhandled content-type:application/pgp-signature] | |