diff options
| author | Ben Hutchings <ben@decadent.org.uk> | 2015-07-21 15:42:59 +0100 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2015-08-07 00:32:13 +0100 |
| commit | 4797489ce83a5f42d0b38089695a48d4a3d1ee0b (patch) | |
| tree | 6d080dae5ed05e765e90b188932adfd8e084b64d | |
| parent | 48793a2e5abc126a6446d8497c2117489622e9db (diff) | |
| download | lwn-4797489ce83a5f42d0b38089695a48d4a3d1ee0b.tar.gz lwn-4797489ce83a5f42d0b38089695a48d4a3d1ee0b.zip | |
x86_64: Fix strnlen_user() to not touch memory after specified maximum
Inspired by commit f18c34e483ff ("lib: Fix strnlen_user() to not touch
memory after specified maximum") upstream. This version of
strnlen_user(), no longer present upstream, has a similar off-by-one
error.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Jan Kara <jack@suse.cz>
| -rw-r--r-- | arch/x86/lib/usercopy_64.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c index 554b7b528f02..433b21d89f5a 100644 --- a/arch/x86/lib/usercopy_64.c +++ b/arch/x86/lib/usercopy_64.c @@ -113,7 +113,7 @@ long __strnlen_user(const char __user *s, long n) char c; while (1) { - if (res>n) + if (res >= n) return n+1; if (__get_user(c, s)) return 0; |