Merge tag 'nfsd-4.5-1' of git://linux-nfs.org/~bfields/linux

81904dbb · Linus Torvalds <[email protected]> · 2016-02-25 19:31:01 -08:00

Pull nfsd bugfix from Bruce Fields:
 "One fix for a bug that could cause a NULL write past the end of a
  buffer in case of unusually long writes to some system interfaces used
  by mountd and other nfs support utilities"

* tag 'nfsd-4.5-1' of git://linux-nfs.org/~bfields/linux:
  sunrpc/cache: fix off-by-one in qword_get()

Commit: 81904dbbb45490642d16fb1343f95dc0d0eec93f
Parents: 3acdb84c · b7052cd7

Merge commit. Changes below are compared with the first parent: 3acdb84c.

Changes

1 files changed · +1 −1

File	Status	Add	Del	Content
net/sunrpc/cache.c	modified	+1	−1	View file

net/sunrpc/cache.c

View file

diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 2b32fd6..273bc3a 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1225,7 +1225,7 @@ int qword_get(char **bpp, char *dest, int bufsize)
 	if (bp[0] == '\\' && bp[1] == 'x') {
 		/* HEX STRING */
 		bp += 2;
-		while (len < bufsize) {
+		while (len < bufsize - 1) {
 			int h, l;
 
 			h = hex_to_bin(bp[0]);