From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Dan Carpenter <error27@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [04/11] irda: off by one
Date: Sat, 18 Sep 2010 11:45:00 -0700 [thread overview]
Message-ID: <20100918184621.234928485@clark.site> (raw)
In-Reply-To: <20100918184651.GA14224@kroah.com>
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dan Carpenter <error27@gmail.com>
commit cf9b94f88bdbe8a02015fc30d7c232b2d262d4ad upstream.
This is an off by one. We would go past the end when we NUL terminate
the "value" string at end of the function. The "value" buffer is
allocated in irlan_client_parse_response() or
irlan_provider_parse_command().
CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/irda/irlan/irlan_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -1100,7 +1100,7 @@ int irlan_extract_param(__u8 *buf, char
memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */
le16_to_cpus(&val_len); n+=2;
- if (val_len > 1016) {
+ if (val_len >= 1016) {
IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ );
return -RSP_INVALID_COMMAND_FORMAT;
}
next prev parent reply other threads:[~2010-09-18 18:48 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
2010-09-18 18:44 ` [01/11] ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open() Greg KH
2010-09-18 18:44 ` [02/11] ath9k_hw: fix parsing of HT40 5 GHz CTLs Greg KH
2010-09-18 18:44 ` [03/11] tracing: Do not allow llseek to set_ftrace_filter Greg KH
2010-09-18 18:45 ` Greg KH [this message]
2010-09-18 18:45 ` [05/11] bounce: call flush_dcache_page() after bounce_copy_vec() Greg KH
2010-09-18 18:45 ` [06/11] x86-64, compat: Test %rax for the syscall number, not %eax Greg KH
2010-09-18 18:45 ` [07/11] compat: Make compat_alloc_user_space() incorporate the access_ok() Greg KH
2010-09-18 18:45 ` [08/11] hwmon: (f75375s) Shift control mode to the correct bit position Greg KH
2010-09-18 18:45 ` [09/11] hwmon: (f75375s) Do not overwrite values read from registers Greg KH
2010-09-18 18:45 ` [10/11] apm_power: Add missing break statement Greg KH
2010-09-18 18:45 ` [11/11] x86-64, compat: Retruncate rax after ia32 syscall entry tracing Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100918184621.234928485@clark.site \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=davem@davemloft.net \
--cc=error27@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®