Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1366658

[PATCH 3.2 35/62] sunrpc/cache: fix off-by-one in qword_get()

Show all headers | View raw

3.2.79-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Hajnoczi <stefanha@redhat.com>

commit b7052cd7bcf3c1478796e93e3dff2b44c9e82943 upstream.

The qword_get() function NUL-terminates its output buffer.  If the input
string is in hex format \xXXXX... and the same length as the output
buffer, there is an off-by-one:

  int qword_get(char **bpp, char *dest, int bufsize)
  {
      ...
      while (len < bufsize) {
          ...
          *dest++ = (h << 4) | l;
          len++;
      }
      ...
      *dest = '\0';
      return len;
  }

This patch ensures the NUL terminator doesn't fall outside the output
buffer.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/sunrpc/cache.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1211,7 +1211,7 @@ int qword_get(char **bpp, char *dest, in
 	if (bp[0] == '\\' && bp[1] == 'x') {
 		/* HEX STRING */
 		bp += 2;
-		while (len < bufsize) {
+		while (len < bufsize - 1) {
 			int h, l;
 
 			h = hex_to_bin(bp[0]);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.2 00/62] 3.2.79-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 27/62] USB: option: add support for SIM7100E Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 13/62] xen/pciback: Check PF instead of VF for  PCI_COMMAND_MEMORY Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 12/62] libata: fix HDIO_GET_32BIT ioctl Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 52/62] ALSA: seq: oss: Don't drain at closing a client Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 41/62] ipr: Fix out-of-bounds null overwrite Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 20/62] af_unix: Don't set err in unix_stream_read_generic  unless there was an error Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 21/62] af_unix: Guard against other == sk in  unix_dgram_sendmsg Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 35/62] sunrpc/cache: fix off-by-one in qword_get() Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 42/62] ipr: Fix regression when loading firmware Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 15/62] xen/pcifront: Fix mysterious crashes when NUMA  locality information was extracted. Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 50/62] ASoC: wm8994: Fix enum ctl accesses in a wrong type Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 49/62] ASoC: wm8958: Fix enum ctl accesses in a wrong type Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:20 +0200
  [PATCH 3.2 57/62] ubi: Fix out of bounds write in volume update code Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 03/62] iommu/vt-d: Fix 64-bit accesses to 32-bit  DMAR_GSTS_REG Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 45/62] ALSA: timer: Fix broken compat timer user  status ioctl Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 05/62] cfg80211/wext: fix message ordering Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 14/62] xen/pciback: Save the number of MSI-X entries  to be copied later. Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 18/62] tracing: Fix freak link error caused by branch  tracer Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 16/62] ALSA: seq: Fix leak of pool buffer at  concurrent writes Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 62/62] HID: usbhid: fix recursive deadlock Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 08/62] drm/i915: fix error path in intel_setup_gmbus() Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 19/62] ALSA: seq: Fix double port list deletion Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 58/62] Revert "drm/radeon: call hpd_irq_event on resume" Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 10/62] s390/dasd: prevent incorrect length error under  z/VM after PAV changes Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 07/62] nfs: fix nfs_size_to_loff_t Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 04/62] wext: fix message delay/ordering Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 06/62] mac80211: fix use of uninitialised values in RX  aggregation Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 46/62] ALSA: hdspm: Fix wrong boolean ctl value accesses Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 01/62] Revert "crypto: algif_skcipher - Do not  dereference ctx without socket lock" Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  [PATCH 3.2 17/62] tracepoints: Do not trace when cpu is offline Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200
  Re: [PATCH 3.2 00/62] 3.2.79-rc1 review Guenter Roeck <linux@roeck-us.net> - 2016-03-29 22:30 +0200
    Re: [PATCH 3.2 00/62] 3.2.79-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 23:10 +0200
  [PATCH 3.2 02/62] crypto: {blk,giv}cipher: Set has_setkey Ben Hutchings <ben@decadent.org.uk> - 2016-03-29 22:30 +0200

csiph-web