| From 5c4bfa17f3ec46becec4b23d12323f7605ebd696 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <error27@gmail.com> |
| Date: Fri, 9 Jul 2010 23:51:54 +0000 |
| Subject: 9p: strlen() doesn't count the terminator |
| |
| From: Dan Carpenter <error27@gmail.com> |
| |
| commit 5c4bfa17f3ec46becec4b23d12323f7605ebd696 upstream. |
| |
| This is an off by one bug because strlen() doesn't count the NULL |
| terminator. We strcpy() addr into a fixed length array of size |
| UNIX_PATH_MAX later on. |
| |
| The addr variable is the name of the device being mounted. |
| |
| Signed-off-by: Dan Carpenter <error27@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/9p/trans_fd.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/9p/trans_fd.c |
| +++ b/net/9p/trans_fd.c |
| @@ -948,7 +948,7 @@ p9_fd_create_unix(struct p9_client *clie |
| |
| csocket = NULL; |
| |
| - if (strlen(addr) > UNIX_PATH_MAX) { |
| + if (strlen(addr) >= UNIX_PATH_MAX) { |
| P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n", |
| addr); |
| err = -ENAMETOOLONG; |
