[2.6 patch] fs/afs/vlocation.c: fix off-by-one

[2.6 patch] fs/afs/vlocation.c: fix off-by-one

[Adrian Bunk]

This patch fixes an off-by-one error spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <bunk@kernel.org>

---
d88aac5aa6057a8d784934dc5035e9e853b16203 
diff --git a/fs/afs/vlocation.c b/fs/afs/vlocation.c
index 7b4bbe4..849fc31 100644
--- a/fs/afs/vlocation.c
+++ b/fs/afs/vlocation.c
@@ -376,19 +376,19 @@ struct afs_vlocation *afs_vlocation_lookup(struct afs_cell *cell,
 					   size_t namesz)
 {
 	struct afs_vlocation *vl;
 	int ret;
 
 	_enter("{%s},{%x},%*.*s,%zu",
 	       cell->name, key_serial(key),
 	       (int) namesz, (int) namesz, name, namesz);
 
-	if (namesz > sizeof(vl->vldb.name)) {
+	if (namesz >= sizeof(vl->vldb.name)) {
 		_leave(" = -ENAMETOOLONG");
 		return ERR_PTR(-ENAMETOOLONG);
 	}
 
 	/* see if we have an in-memory copy first */
 	down_write(&cell->vl_sem);
 	spin_lock(&cell->vl_lock);
 	list_for_each_entry(vl, &cell->vl_list, link) {
 		if (vl->vldb.name[namesz] != '\0')

Re: [2.6 patch] fs/afs/vlocation.c: fix off-by-one

[David Howells]

Adrian Bunk <bunk@kernel.org> wrote:

> This patch fixes an off-by-one error spotted by the Coverity checker.

NAK.

Why do you assume it's a NUL-terminated string?  It's not.  It's a fixed
length character array that gets padded out with NULs.

Look 9 lines further down in the file from the change you made.  You'll notice
it is using memcmp() not strcmp().

David

Re: [2.6 patch] fs/afs/vlocation.c: fix off-by-one

[Adrian Bunk]

On Mon, Oct 29, 2007 at 01:00:26PM +0000, David Howells wrote:
> Adrian Bunk <bunk@kernel.org> wrote:
> 
> > This patch fixes an off-by-one error spotted by the Coverity checker.
> 
> NAK.
> 
> Why do you assume it's a NUL-terminated string?  It's not.  It's a fixed
> length character array that gets padded out with NULs.
> 
> Look 9 lines further down in the file from the change you made.  You'll notice
> it is using memcmp() not strcmp().

Check the last line of the patch I sent:
  if (vl->vldb.name[namesz] != '\0')

> David

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: [2.6 patch] fs/afs/vlocation.c: fix off-by-one

[David Howells]

Adrian Bunk <bunk@kernel.org> wrote:

> Check the last line of the patch I sent:
>   if (vl->vldb.name[namesz] != '\0')

Seems I forgotten some of what my own code does:-)

Actually, you're right.  I added in a gap for the NUL.  Okay, I retract my
NAK.  Consider it ACK'd instead.

David