summaryrefslogtreecommitdiffstats
path: root/fs/cifs
diff options
context:
space:
mode:
authorInsu Yun <wuninsu@gmail.com>2016-02-01 11:34:58 -0500
committerSteve French <smfrench@gmail.com>2016-02-10 18:04:56 -0600
commitf34d69c3e54908c97708d0d65075f7c6074fc87e (patch)
treea474276b61cd22d01cfc53fa3d77f3f3153b245b /fs/cifs
parent997152f62751b7d16f1b864121c912fd19032bdf (diff)
downloadlinux-f34d69c3e54908c97708d0d65075f7c6074fc87e.tar.gz
linux-f34d69c3e54908c97708d0d65075f7c6074fc87e.tar.bz2
linux-f34d69c3e54908c97708d0d65075f7c6074fc87e.zip
cifs: fix potential overflow in cifs_compose_mount_options
In worst case, "ip=" + sb_mountdata + ipv6 can be copied into mountdata. Therefore, for safe, it is better to add more size when allocating memory. Signed-off-by: Insu Yun <wuninsu@gmail.com> Signed-off-by: Steve French <smfrench@gmail.com>
Diffstat (limited to 'fs/cifs')
-rw-r--r--fs/cifs/cifs_dfs_ref.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 7dc886c9a78f..e956cba94338 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -175,7 +175,7 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
* string to the length of the original string to allow for worst case.
*/
md_len = strlen(sb_mountdata) + INET6_ADDRSTRLEN;
- mountdata = kzalloc(md_len + 1, GFP_KERNEL);
+ mountdata = kzalloc(md_len + sizeof("ip=") + 1, GFP_KERNEL);
if (mountdata == NULL) {
rc = -ENOMEM;
goto compose_mount_options_err;