* [patch] irda: off by one
@ 2010-09-04 13:14 Dan Carpenter
2010-09-07 1:35 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2010-09-04 13:14 UTC (permalink / raw)
To: Samuel Ortiz
Cc: David S. Miller, Alexey Dobriyan, Li Zefan, netdev,
kernel-janitors
This is an off by one. We would go past the end when we NUL terminate
the "value" string at end of the function. The "value" buffer is
allocated in irlan_client_parse_response() or
irlan_provider_parse_command().
CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index a788f9e..6130f9d 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -1102,7 +1102,7 @@ int irlan_extract_param(__u8 *buf, char *name, char *value, __u16 *len)
memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */
le16_to_cpus(&val_len); n+=2;
- if (val_len > 1016) {
+ if (val_len >= 1016) {
IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ );
return -RSP_INVALID_COMMAND_FORMAT;
}
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch] irda: off by one
2010-09-04 13:14 [patch] irda: off by one Dan Carpenter
@ 2010-09-07 1:35 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2010-09-07 1:35 UTC (permalink / raw)
To: error27; +Cc: samuel, adobriyan, lizf, netdev, kernel-janitors
From: Dan Carpenter <error27@gmail.com>
Date: Sat, 4 Sep 2010 15:14:35 +0200
> This is an off by one. We would go past the end when we NUL terminate
> the "value" string at end of the function. The "value" buffer is
> allocated in irlan_client_parse_response() or
> irlan_provider_parse_command().
>
> CC: stable@kernel.org
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-09-07 1:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-09-04 13:14 [patch] irda: off by one Dan Carpenter
2010-09-07 1:35 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).