| From 2fb2b19bdf029ac8c064c7570bd225ce90531b55 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <error27@gmail.com> |
| Date: Sat, 4 Sep 2010 03:14:35 +0000 |
| Subject: [PATCH] irda: off by one |
| |
| commit cf9b94f88bdbe8a02015fc30d7c232b2d262d4ad upstream. |
| |
| This is an off by one. We would go past the end when we NUL terminate |
| the "value" string at end of the function. The "value" buffer is |
| allocated in irlan_client_parse_response() or |
| irlan_provider_parse_command(). |
| |
| Signed-off-by: Dan Carpenter <error27@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| --- |
| net/irda/irlan/irlan_common.c | 2 +- |
| 1 files changed, 1 insertions(+), 1 deletions(-) |
| |
| diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c |
| index a788f9e..6130f9d 100644 |
| --- a/net/irda/irlan/irlan_common.c |
| +++ b/net/irda/irlan/irlan_common.c |
| @@ -1102,7 +1102,7 @@ int irlan_extract_param(__u8 *buf, char *name, char *value, __u16 *len) |
| memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */ |
| le16_to_cpus(&val_len); n+=2; |
| |
| - if (val_len > 1016) { |
| + if (val_len >= 1016) { |
| IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ ); |
| return -RSP_INVALID_COMMAND_FORMAT; |
| } |
| -- |
| 1.7.0.4 |
| |
