lkml.org 
[lkml]   [2005]   [Sep]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] nfs client, kernel 2.4.31: readlink result overflow
From
Date
On Mon, 12 Sep 2005 16:41:19 EDT, Assar said:
> Valdis.Kletnieks@vt.edu writes:
> > > To my reading, the 2.6.13 code does not copy the 4 bytes of length to
> > > rcvbuf.
> >
> > Hmm... it still does this:
> > kaddr[len+rcvbuf->page_base] = '\0';
> > which still has a possible off-by-one? (Was that why you have -1 -4?)
>
> The check is different. 2.6.13 is using ">=" instead of ">", so hence
> I think that's fine.

Argh. Where's my reading glasses? ;) Yes, a >= check works there....

> + if (len > rcvbuf->page_len - sizeof(*strlen) - 1)
> + len = rcvbuf->page_len - sizeof(*strlen) - 1;

OK, looks saner to me, but Trond and Marcelo probably get to make the final decision ;)
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-09-12 22:56    [W:0.056 / U:0.344 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site