Skip to content

Commit

Permalink
9p: strlen() doesn't count the terminator
Browse files Browse the repository at this point in the history
This is an off by one bug because strlen() doesn't count the NULL
terminator.  We strcpy() addr into a fixed length array of size
UNIX_PATH_MAX later on.

The addr variable is the name of the device being mounted.

CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Dan Carpenter authored and David S. Miller committed Jul 13, 2010
1 parent b31fb86 commit 5c4bfa1
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion net/9p/trans_fd.c
Original file line number Diff line number Diff line change
Expand Up @@ -948,7 +948,7 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)

csocket = NULL;

if (strlen(addr) > UNIX_PATH_MAX) {
if (strlen(addr) >= UNIX_PATH_MAX) {
P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n",
addr);
return -ENAMETOOLONG;
Expand Down

0 comments on commit 5c4bfa1

Please sign in to comment.