Skip to content

Commit

Permalink
9p: strlen() doesn't count the terminator
Browse files Browse the repository at this point in the history
This is an off by one bug because strlen() doesn't count the NULL
terminator.  We strcpy() addr into a fixed length array of size
UNIX_PATH_MAX later on.

The addr variable is the name of the device being mounted.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
  • Loading branch information
Dan Carpenter authored and Eric Van Hensbergen committed Aug 2, 2010
1 parent b126468 commit cff6b8a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion net/9p/trans_fd.c
Original file line number Diff line number Diff line change
Expand Up @@ -948,7 +948,7 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)

csocket = NULL;

if (strlen(addr) > UNIX_PATH_MAX) {
if (strlen(addr) >= UNIX_PATH_MAX) {
P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n",
addr);
return -ENAMETOOLONG;
Expand Down

0 comments on commit cff6b8a

Please sign in to comment.