diff options
| author | Linus Torvalds | 2016-02-25 19:31:01 -0800 |
|---|---|---|
| committer | Linus Torvalds | 2016-02-25 19:31:01 -0800 |
| commit | 81904dbbb45490642d16fb1343f95dc0d0eec93f (patch) | |
| tree | f9680651315b6051b356f69c543643c596d61e36 | |
| parent | 3acdb84c22fc5fcd8384ff0238b62cceba8ed549 (diff) | |
| parent | b7052cd7bcf3c1478796e93e3dff2b44c9e82943 (diff) | |
Merge tag 'nfsd-4.5-1' of git://linux-nfs.org/~bfields/linux
Pull nfsd bugfix from Bruce Fields:
"One fix for a bug that could cause a NULL write past the end of a
buffer in case of unusually long writes to some system interfaces used
by mountd and other nfs support utilities"
* tag 'nfsd-4.5-1' of git://linux-nfs.org/~bfields/linux:
sunrpc/cache: fix off-by-one in qword_get()
| -rw-r--r-- | net/sunrpc/cache.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c index 2b32fd602669..273bc3a35425 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -1225,7 +1225,7 @@ int qword_get(char **bpp, char *dest, int bufsize) if (bp[0] == '\\' && bp[1] == 'x') { /* HEX STRING */ bp += 2; - while (len < bufsize) { + while (len < bufsize - 1) { int h, l; h = hex_to_bin(bp[0]); |