Messages in this thread | | | From | (Eric W. Biederman) | Date | Fri, 04 Feb 2011 13:09:38 -0800 | Subject | Re: [PATCH] sysctl: fix binary sysctl overflow |
| |
Lucian Adrian Grijincu <lucian.grijincu@gmail.com> writes:
> We allocated a vector of CTL_MAXNAME elements and considered > [0, CTL_MAXNAME] as valid indexes in the vector. > > This fixes valid index range to be [0, CTL_MAXNAME). > > I guess this should be backported to stable trees too.
No. This part of the code is correct. 0 is a valid index, and the array is only CTL_MAXNAME entries long.
I think the maximum depth of this table is only about 6, but feel free to count and tell me CTL_MAXNAME is set too low.
Eric
> > Signed-off-by: Lucian Adrian Grijincu <lucian.grijincu@gmail.com> > --- > kernel/sysctl_binary.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c > index b875bed..e2f377c 100644 > --- a/kernel/sysctl_binary.c > +++ b/kernel/sysctl_binary.c > @@ -1446,7 +1446,7 @@ static ssize_t do_sysctl(int __user *args_name, int nlen, > int i; > > /* Check args->nlen. */ > - if (nlen < 0 || nlen > CTL_MAXNAME) > + if (nlen < 0 || nlen >= CTL_MAXNAME) > return -ENOTDIR; > /* Read in the sysctl name for simplicity */ > for (i = 0; i < nlen; i++)
| |