| From df1778be1a33edffa51d094eeda87c858ded6560 Mon Sep 17 00:00:00 2001 |
| From: Xi Wang <xi.wang@gmail.com> |
| Date: Wed, 27 Feb 2013 17:05:21 -0800 |
| Subject: sysctl: fix null checking in bin_dn_node_address() |
| |
| From: Xi Wang <xi.wang@gmail.com> |
| |
| commit df1778be1a33edffa51d094eeda87c858ded6560 upstream. |
| |
| The null check of `strchr() + 1' is broken, which is always non-null, |
| leading to OOB read. Instead, check the result of strchr(). |
| |
| Signed-off-by: Xi Wang <xi.wang@gmail.com> |
| Cc: "Eric W. Biederman" <ebiederm@xmission.com> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| kernel/sysctl_binary.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/kernel/sysctl_binary.c |
| +++ b/kernel/sysctl_binary.c |
| @@ -1194,9 +1194,10 @@ static ssize_t bin_dn_node_address(struc |
| |
| /* Convert the decnet address to binary */ |
| result = -EIO; |
| - nodep = strchr(buf, '.') + 1; |
| + nodep = strchr(buf, '.'); |
| if (!nodep) |
| goto out; |
| + ++nodep; |
| |
| area = simple_strtoul(buf, NULL, 10); |
| node = simple_strtoul(nodep, NULL, 10); |
