* [PATCH] sysctl: fix null checking in bin_dn_node_address()
@ 2013-01-22 14:58 Xi Wang
0 siblings, 0 replies; only message in thread
From: Xi Wang @ 2013-01-22 14:58 UTC (permalink / raw)
To: linux-kernel; +Cc: Eric W. Biederman, Xi Wang, stable
The null check of `strchr() + 1' is broken, which is always non-null,
leading to OOB read. Instead, check the result of strchr().
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Cc: stable@vger.kernel.org
---
kernel/sysctl_binary.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 5a63844..0ddf3a0 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1194,9 +1194,10 @@ static ssize_t bin_dn_node_address(struct file *file,
/* Convert the decnet address to binary */
result = -EIO;
- nodep = strchr(buf, '.') + 1;
+ nodep = strchr(buf, '.');
if (!nodep)
goto out;
+ ++nodep;
area = simple_strtoul(buf, NULL, 10);
node = simple_strtoul(nodep, NULL, 10);
--
1.7.10.4
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2013-01-22 14:58 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-01-22 14:58 [PATCH] sysctl: fix null checking in bin_dn_node_address() Xi Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome