From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755166Ab0IRTxt (ORCPT ); Sat, 18 Sep 2010 15:53:49 -0400 Received: from kroah.org ([198.145.64.141]:51365 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754222Ab0IRTBk (ORCPT ); Sat, 18 Sep 2010 15:01:40 -0400 X-Mailbox-Line: From gregkh@clark.site Sat Sep 18 11:59:56 2010 Message-Id: <20100918185956.844186089@clark.site> User-Agent: quilt/0.48-11.2 Date: Sat, 18 Sep 2010 11:58:11 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Dan Carpenter , "David S. Miller" Subject: [047/123] irda: off by one References: <20100918185724.290702750@clark.site> Content-Disposition: inline; filename=irda-off-by-one.patch In-Reply-To: <20100918190024.GA14388@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dan Carpenter commit cf9b94f88bdbe8a02015fc30d7c232b2d262d4ad upstream. This is an off by one. We would go past the end when we NUL terminate the "value" string at end of the function. The "value" buffer is allocated in irlan_client_parse_response() or irlan_provider_parse_command(). CC: stable@kernel.org Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller --- net/irda/irlan/irlan_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/irda/irlan/irlan_common.c +++ b/net/irda/irlan/irlan_common.c @@ -1101,7 +1101,7 @@ int irlan_extract_param(__u8 *buf, char memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */ le16_to_cpus(&val_len); n+=2; - if (val_len > 1016) { + if (val_len >= 1016) { IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ ); return -RSP_INVALID_COMMAND_FORMAT; }