mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
iscsi-target: fix extract_param to handle buffer length corner case
extract_param() is called with max_length set to the total size of the output buffer. It's not safe to allow a parameter length equal to the buffer size as the terminating null would be written one byte past the end of the output buffer. Signed-off-by: Eric Seppanen <eric@purestorage.com> Cc: <stable@vger.kernel.org> #3.1+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
This commit is contained in:
parent
d1fa7a1d50
commit
369653e4fb
1 changed files with 1 additions and 1 deletions
|
@ -88,7 +88,7 @@ int extract_param(
|
|||
if (len < 0)
|
||||
return -1;
|
||||
|
||||
if (len > max_length) {
|
||||
if (len >= max_length) {
|
||||
pr_err("Length of input: %d exceeds max_length:"
|
||||
" %d\n", len, max_length);
|
||||
return -1;
|
||||
|
|
Loading…
Reference in a new issue