summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2013-09-06 16:55:36 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2013-09-07 19:54:55 -0400
commitdfc59e2c90f780653e7b0b749c2a547a9bb1b2ce (patch)
tree79f0b0f0867348e16390e58e2e5282722dedf372
parent5d8943b04bab62614559f308b4e39533ca7f8e08 (diff)
downloadlinux-stable-dfc59e2c90f780653e7b0b749c2a547a9bb1b2ce.tar.gz
linux-stable-dfc59e2c90f780653e7b0b749c2a547a9bb1b2ce.tar.bz2
linux-stable-dfc59e2c90f780653e7b0b749c2a547a9bb1b2ce.zip
exportfs: don't assume that ->iterate() won't feed us too long entries
On some filesystems it's impossible even with fs corruption, but we'd better not rely on that, what with memcpy() into on-stack array we are doing there. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r--fs/exportfs/expfs.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 293bc2e47a73..a235f0016889 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -231,7 +231,7 @@ static int filldir_one(void * __buf, const char * name, int len,
int result = 0;
buf->sequence++;
- if (buf->ino == ino) {
+ if (buf->ino == ino && len <= NAME_MAX) {
memcpy(buf->name, name, len);
buf->name[len] = '\0';
buf->found = 1;