* [patch] irda: off by one
@ 2010-09-04 13:14 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2010-09-04 13:14 UTC (permalink / raw)
To: Samuel Ortiz
Cc: David S. Miller, Alexey Dobriyan, Li Zefan, netdev,
kernel-janitors
This is an off by one. We would go past the end when we NUL terminate
the "value" string at end of the function. The "value" buffer is
allocated in irlan_client_parse_response() or
irlan_provider_parse_command().
CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index a788f9e..6130f9d 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -1102,7 +1102,7 @@ int irlan_extract_param(__u8 *buf, char *name, char *value, __u16 *len)
memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */
le16_to_cpus(&val_len); n+=2;
- if (val_len > 1016) {
+ if (val_len >= 1016) {
IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ );
return -RSP_INVALID_COMMAND_FORMAT;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] irda: off by one
@ 2010-09-04 13:14 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2010-09-04 13:14 UTC (permalink / raw)
To: Samuel Ortiz
Cc: David S. Miller, Alexey Dobriyan, Li Zefan, netdev,
kernel-janitors
This is an off by one. We would go past the end when we NUL terminate
the "value" string at end of the function. The "value" buffer is
allocated in irlan_client_parse_response() or
irlan_provider_parse_command().
CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index a788f9e..6130f9d 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -1102,7 +1102,7 @@ int irlan_extract_param(__u8 *buf, char *name, char *value, __u16 *len)
memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */
le16_to_cpus(&val_len); n+=2;
- if (val_len > 1016) {
+ if (val_len >= 1016) {
IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ );
return -RSP_INVALID_COMMAND_FORMAT;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch] irda: off by one
2010-09-04 13:14 ` Dan Carpenter
@ 2010-09-07 1:35 ` David Miller
-1 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2010-09-07 1:35 UTC (permalink / raw)
To: error27; +Cc: samuel, adobriyan, lizf, netdev, kernel-janitors
From: Dan Carpenter <error27@gmail.com>
Date: Sat, 4 Sep 2010 15:14:35 +0200
> This is an off by one. We would go past the end when we NUL terminate
> the "value" string at end of the function. The "value" buffer is
> allocated in irlan_client_parse_response() or
> irlan_provider_parse_command().
>
> CC: stable@kernel.org
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] irda: off by one
@ 2010-09-07 1:35 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2010-09-07 1:35 UTC (permalink / raw)
To: error27; +Cc: samuel, adobriyan, lizf, netdev, kernel-janitors
From: Dan Carpenter <error27@gmail.com>
Date: Sat, 4 Sep 2010 15:14:35 +0200
> This is an off by one. We would go past the end when we NUL terminate
> the "value" string at end of the function. The "value" buffer is
> allocated in irlan_client_parse_response() or
> irlan_provider_parse_command().
>
> CC: stable@kernel.org
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-09-07 1:35 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-09-04 13:14 [patch] irda: off by one Dan Carpenter
2010-09-04 13:14 ` Dan Carpenter
2010-09-07 1:35 ` David Miller
2010-09-07 1:35 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.