diff options
| author | Alex Ng <alexng@messages.microsoft.com> | 2017-08-06 13:12:56 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-08-16 09:14:43 -0700 |
| commit | ddce54b6a95ed5ee3011b4771fda69c2d8a6d538 (patch) | |
| tree | a48be6817b6de2ae570db9c312325a6be6575c83 | |
| parent | c548f3957efa57b6f1a1f4c90013232f6f488682 (diff) | |
| download | linux-ddce54b6a95ed5ee3011b4771fda69c2d8a6d538.tar.gz linux-ddce54b6a95ed5ee3011b4771fda69c2d8a6d538.tar.bz2 linux-ddce54b6a95ed5ee3011b4771fda69c2d8a6d538.zip | |
Drivers: hv: kvp: Use MAX_ADAPTER_ID_SIZE for translating adapter id
There's a bug which passes the output buffer size as MAX_IP_ADDR_SIZE,
when converting the adapter_id field to UTF16. This is much larger than
the actual size (MAX_ADAPTER_ID_SIZE). Fix this by passing the proper
size.
Fortunately, the translation is limited by the length of the input. This
explains why we haven't seen output buffer overflow conditions.
Signed-off-by: Alex Ng <alexng@messages.microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/hv/hv_kvp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c index 9a90b915b5be..5eed1e7da15c 100644 --- a/drivers/hv/hv_kvp.c +++ b/drivers/hv/hv_kvp.c @@ -304,7 +304,7 @@ static int process_ob_ipinfo(void *in_msg, void *out_msg, int op) strlen((char *)in->body.kvp_ip_val.adapter_id), UTF16_HOST_ENDIAN, (wchar_t *)out->kvp_ip_val.adapter_id, - MAX_IP_ADDR_SIZE); + MAX_ADAPTER_ID_SIZE); if (len < 0) return len; |