lkml.org 
[lkml]   [2011]   [Feb]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] sysctl: fix binary sysctl overflow
Lucian Adrian Grijincu <lucian.grijincu@gmail.com> writes:

> We allocated a vector of CTL_MAXNAME elements and considered
> [0, CTL_MAXNAME] as valid indexes in the vector.
>
> This fixes valid index range to be [0, CTL_MAXNAME).
>
> I guess this should be backported to stable trees too.

No. This part of the code is correct. 0 is a valid index,
and the array is only CTL_MAXNAME entries long.

I think the maximum depth of this table is only about 6, but
feel free to count and tell me CTL_MAXNAME is set too low.

Eric


>
> Signed-off-by: Lucian Adrian Grijincu <lucian.grijincu@gmail.com>
> ---
> kernel/sysctl_binary.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
> index b875bed..e2f377c 100644
> --- a/kernel/sysctl_binary.c
> +++ b/kernel/sysctl_binary.c
> @@ -1446,7 +1446,7 @@ static ssize_t do_sysctl(int __user *args_name, int nlen,
> int i;
>
> /* Check args->nlen. */
> - if (nlen < 0 || nlen > CTL_MAXNAME)
> + if (nlen < 0 || nlen >= CTL_MAXNAME)
> return -ENOTDIR;
> /* Read in the sysctl name for simplicity */
> for (i = 0; i < nlen; i++)


\
 
 \ /
  Last update: 2011-02-04 22:11    [W:0.048 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site