From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Date: Thu, 31 Jul 2014 18:30:11 +0300 > 1) We don't allocate enough space for the NUL terminator so we end up > corrupting one character beyond the end of the buffer. > > 2) The "len - 1" should just be "len". The code is trying to copy a > word from a buffer up to a comma or the last word in the buffer. > Say you have the buffer, "foo,bar,baz", then this code truncates the > last letter off each word so you get "fo", "ba", and "ba". You would > hope this kind of bug would get noticed in testing... > > I'm not very familiar with this code and I can't test it, but I think > we should copy the final character. > > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Applied to net-next, thanks Dan. -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
