lkml.org 
[lkml]   [2021]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH linux-next] init/do_mounts: fix potential memory out of bounds access
Date
From: xu xin <xu.xin16@zte.com.cn>

Initially the pointer "p" points to the start of "pages".
In the loop "while(*p++) {...}", it ends when "*p" equals
to zero. Just after that, the pointer "p" moves forward
with "p++", so "p" may points ouf of "pages".

furthermore, it is no use to set *p = '\0', so we remove it.

Reported-by: Zeal Robot <zealci@zte.com.cn>
Acked-by: zhang yunkai<zhang.yunkai@zte.com.cn>
Signed-off-by: xu xin <xu.xin16@zte.com.cn>
---
init/do_mounts.c | 1 -
1 file changed, 1 deletion(-)

diff --git a/init/do_mounts.c b/init/do_mounts.c
index 2ed30ff6c906..ee1172599249 100644
--- a/init/do_mounts.c
+++ b/init/do_mounts.c
@@ -348,7 +348,6 @@ static int __init split_fs_names(char *page, char *names)
if (p[-1] == ',')
p[-1] = '\0';
}
- *p = '\0';

for (p = page; *p; p += strlen(p)+1)
count++;
--
2.25.1
\
 
 \ /
  Last update: 2021-09-13 13:44    [W:0.070 / U:1.392 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site