Messages in this thread Patch in this message | | | From | cgel.zte@gmail ... | Subject | [PATCH linux-next] init/do_mounts: fix potential memory out of bounds access | Date | Mon, 13 Sep 2021 11:43:36 +0000 |
| |
From: xu xin <xu.xin16@zte.com.cn>
Initially the pointer "p" points to the start of "pages". In the loop "while(*p++) {...}", it ends when "*p" equals to zero. Just after that, the pointer "p" moves forward with "p++", so "p" may points ouf of "pages".
furthermore, it is no use to set *p = '\0', so we remove it.
Reported-by: Zeal Robot <zealci@zte.com.cn> Acked-by: zhang yunkai<zhang.yunkai@zte.com.cn> Signed-off-by: xu xin <xu.xin16@zte.com.cn> --- init/do_mounts.c | 1 - 1 file changed, 1 deletion(-)
diff --git a/init/do_mounts.c b/init/do_mounts.c index 2ed30ff6c906..ee1172599249 100644 --- a/init/do_mounts.c +++ b/init/do_mounts.c @@ -348,7 +348,6 @@ static int __init split_fs_names(char *page, char *names) if (p[-1] == ',') p[-1] = '\0'; } - *p = '\0'; for (p = page; *p; p += strlen(p)+1) count++; -- 2.25.1
| |