lkml.org 
[lkml]   [2013]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 058/212] iscsi-target: fix extract_param to handle buffer length corner case
    Date
    3.12-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Seppanen <eric@purestorage.com>

    commit 369653e4fb511928511b0ce81f41c812ff1f28b6 upstream.

    extract_param() is called with max_length set to the total size of the
    output buffer. It's not safe to allow a parameter length equal to the
    buffer size as the terminating null would be written one byte past the
    end of the output buffer.

    Signed-off-by: Eric Seppanen <eric@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/target/iscsi/iscsi_target_nego.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/target/iscsi/iscsi_target_nego.c
    +++ b/drivers/target/iscsi/iscsi_target_nego.c
    @@ -88,7 +88,7 @@ int extract_param(
    if (len < 0)
    return -1;

    - if (len > max_length) {
    + if (len >= max_length) {
    pr_err("Length of input: %d exceeds max_length:"
    " %d\n", len, max_length);
    return -1;



    \
     
     \ /
      Last update: 2013-12-02 21:41    [W:3.141 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site