summaryrefslogtreecommitdiff
path: root/net/sunrpc
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2016-02-25 19:31:01 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2016-02-25 19:31:01 -0800
commit81904dbbb45490642d16fb1343f95dc0d0eec93f (patch)
treef9680651315b6051b356f69c543643c596d61e36 /net/sunrpc
parent3acdb84c22fc5fcd8384ff0238b62cceba8ed549 (diff)
parentb7052cd7bcf3c1478796e93e3dff2b44c9e82943 (diff)
Merge tag 'nfsd-4.5-1' of git://linux-nfs.org/~bfields/linux
Pull nfsd bugfix from Bruce Fields: "One fix for a bug that could cause a NULL write past the end of a buffer in case of unusually long writes to some system interfaces used by mountd and other nfs support utilities" * tag 'nfsd-4.5-1' of git://linux-nfs.org/~bfields/linux: sunrpc/cache: fix off-by-one in qword_get()
Diffstat (limited to 'net/sunrpc')
-rw-r--r--net/sunrpc/cache.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 2b32fd602669..273bc3a35425 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1225,7 +1225,7 @@ int qword_get(char **bpp, char *dest, int bufsize)
if (bp[0] == '\\' && bp[1] == 'x') {
/* HEX STRING */
bp += 2;
- while (len < bufsize) {
+ while (len < bufsize - 1) {
int h, l;
h = hex_to_bin(bp[0]);