diff options
| author | Ben Hutchings <ben@decadent.org.uk> | 2015-07-21 15:42:59 +0100 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2015-09-18 13:52:03 +0200 |
| commit | 7d746dd5e6813a31d2ccfb923c6ea9c53e00d0c4 (patch) | |
| tree | 3e192cce20c2204a9b3b643b23534ba7a8c0765a | |
| parent | 7366056a9f1943d924cf78f4e4924d6bbe06b607 (diff) | |
| download | lwn-7d746dd5e6813a31d2ccfb923c6ea9c53e00d0c4.tar.gz lwn-7d746dd5e6813a31d2ccfb923c6ea9c53e00d0c4.zip | |
x86_64: Fix strnlen_user() to not touch memory after specified maximum
Inspired by commit f18c34e483ff ("lib: Fix strnlen_user() to not touch
memory after specified maximum") upstream. This version of
strnlen_user(), no longer present upstream, has a similar off-by-one
error.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Jan Kara <jack@suse.cz>
(cherry picked from commit 4797489ce83a5f42d0b38089695a48d4a3d1ee0b)
Signed-off-by: Willy Tarreau <w@1wt.eu>
| -rw-r--r-- | arch/x86/lib/usercopy_64.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c index b7c2849ffb66..3428d916fd89 100644 --- a/arch/x86/lib/usercopy_64.c +++ b/arch/x86/lib/usercopy_64.c @@ -113,7 +113,7 @@ long __strnlen_user(const char __user *s, long n) char c; while (1) { - if (res>n) + if (res >= n) return n+1; if (__get_user(c, s)) return 0; |