]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/commit
ipr: Fix out-of-bounds null overwrite
authorInsu Yun <wuninsu@gmail.com>
Wed, 6 Jan 2016 17:44:01 +0000 (12:44 -0500)
committerTim Gardner <tim.gardner@canonical.com>
Thu, 21 Apr 2016 12:53:25 +0000 (06:53 -0600)
commitac54868df733ee2ea71a2d3f62d985c004325e30
tree8a0434835281599610ce1f2a341e4f8853918c5f
parent4c49d96521499eaec3e4085fd33447081179801a
ipr: Fix out-of-bounds null overwrite

BugLink: http://bugs.launchpad.net/bugs/1572722
commit d63c7dd5bcb9441af0526d370c43a65ca2c980d9 upstream.

Return value of snprintf is not bound by size value, 2nd argument.
(https://www.kernel.org/doc/htmldocs/kernel-api/API-snprintf.html).
Return value is number of printed chars, can be larger than 2nd
argument.  Therefore, it can write null byte out of bounds ofbuffer.
Since snprintf puts null, it does not need to put additional null byte.

Signed-off-by: Insu Yun <wuninsu@gmail.com>
Reviewed-by: Shane Seymour <shane.seymour@hpe.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
drivers/scsi/ipr.c