]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
sunrpc/cache: fix off-by-one in qword_get()
authorStefan Hajnoczi <stefanha@redhat.com>
Thu, 18 Feb 2016 18:55:54 +0000 (18:55 +0000)
committerJ. Bruce Fields <bfields@redhat.com>
Tue, 23 Feb 2016 18:20:16 +0000 (13:20 -0500)
commitb7052cd7bcf3c1478796e93e3dff2b44c9e82943
tree2264d2685b4de8bd3807e80bdafac468265acf5e
parent18558cae0272f8fd9647e69d3fec1565a7949865
sunrpc/cache: fix off-by-one in qword_get()

The qword_get() function NUL-terminates its output buffer.  If the input
string is in hex format \xXXXX... and the same length as the output
buffer, there is an off-by-one:

  int qword_get(char **bpp, char *dest, int bufsize)
  {
      ...
      while (len < bufsize) {
          ...
          *dest++ = (h << 4) | l;
          len++;
      }
      ...
      *dest = '\0';
      return len;
  }

This patch ensures the NUL terminator doesn't fall outside the output
buffer.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
net/sunrpc/cache.c