lkml.org 
[lkml]   [2016]   [Jan]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v3] ipr: fix out-of-bounds null overwrite
From
Date
>>>>> "Insu" == Insu Yun <wuninsu@gmail.com> writes:

Insu> Return value of snprintf is not bound by size value, 2nd argument.
Insu> (https://www.kernel.org/doc/htmldocs/kernel-api/API-snprintf.html).
Insu> Return value is number of printed chars, can be larger than 2nd
Insu> argument. Therefore, it can write null byte out of bounds
Insu> ofbuffer. Since snprintf puts null, it does not need to put
Insu> additional null byte.

Applied to 4.5/scsi-queue.

--
Martin K. Petersen Oracle Linux Engineering

\
 
 \ /
  Last update: 2016-01-08 04:01    [W:0.042 / U:0.332 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site