diff options
| author | Fedor Tokarev <ftokarev@gmail.com> | 2020-03-28 14:56:55 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-06-25 15:33:00 +0200 |
| commit | 9d9547be1f97ae294e26244ed1b602ec30b5c78d (patch) | |
| tree | 8b77b299b82dd9b95a1dd783536f8b49863015a9 /net | |
| parent | 66820e46384260f7c4ec863a804d6d44fca1b68d (diff) | |
| download | linux-stable-9d9547be1f97ae294e26244ed1b602ec30b5c78d.tar.gz linux-stable-9d9547be1f97ae294e26244ed1b602ec30b5c78d.tar.bz2 linux-stable-9d9547be1f97ae294e26244ed1b602ec30b5c78d.zip | |
net: sunrpc: Fix off-by-one issues in 'rpc_ntop6'
[ Upstream commit 118917d696dc59fd3e1741012c2f9db2294bed6f ]
Fix off-by-one issues in 'rpc_ntop6':
- 'snprintf' returns the number of characters which would have been
written if enough space had been available, excluding the terminating
null byte. Thus, a return value of 'sizeof(scopebuf)' means that the
last character was dropped.
- 'strcat' adds a terminating null byte to the string, thus if len ==
buflen, the null byte is written past the end of the buffer.
Signed-off-by: Fedor Tokarev <ftokarev@gmail.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sunrpc/addr.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c index 2e0a6f92e563..8391c2785550 100644 --- a/net/sunrpc/addr.c +++ b/net/sunrpc/addr.c @@ -81,11 +81,11 @@ static size_t rpc_ntop6(const struct sockaddr *sap, rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u", IPV6_SCOPE_DELIMITER, sin6->sin6_scope_id); - if (unlikely((size_t)rc > sizeof(scopebuf))) + if (unlikely((size_t)rc >= sizeof(scopebuf))) return 0; len += rc; - if (unlikely(len > buflen)) + if (unlikely(len >= buflen)) return 0; strcat(buf, scopebuf); |