On Wed, 2013-11-20 at 14:19 -0800, Eric Seppanen wrote:
> extract_param() is called with max_length set to the total size of the
> output buffer. It's not safe to allow a parameter length equal to the
> buffer size as the terminating null would be written one byte past the
> end of the output buffer.
>
> Signed-off-by: Eric Seppanen <eric@xxxxxxxxxxxxxxx>
> ---
Applied, with a CC' to stable.
Thanks Eric!
--nab
> drivers/target/iscsi/iscsi_target_nego.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
> index ef6d836..a972145 100644
> --- a/drivers/target/iscsi/iscsi_target_nego.c
> +++ b/drivers/target/iscsi/iscsi_target_nego.c
> @@ -88,7 +88,7 @@ int extract_param(
> if (len < 0)
> return -1;
>
> - if (len > max_length) {
> + if (len >= max_length) {
> pr_err("Length of input: %d exceeds max_length:"
> " %d\n", len, max_length);
> return -1;
--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
