diff options
| author | Li Zefan <lizf@cn.fujitsu.com> | 2009-05-15 11:07:56 +0800 |
|---|---|---|
| committer | Steven Rostedt <rostedt@goodmis.org> | 2009-05-14 23:55:12 -0400 |
| commit | 5872144f64b34a5942f6b4acedc90b02de72c58b (patch) | |
| tree | 65ab10576155c05d7ac319197896a31721f61499 /kernel/trace | |
| parent | 8cd995b6deedf98b7694ed32a786ee7f793d1eec (diff) | |
| download | lwn-5872144f64b34a5942f6b4acedc90b02de72c58b.tar.gz lwn-5872144f64b34a5942f6b4acedc90b02de72c58b.zip | |
tracing/filters: fix off-by-one bug
We should leave the last slot for the ending '\0'.
[ Impact: fix possible crash when the length of an operand is 128 ]
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
LKML-Reference: <4A0CDC8C.30602@cn.fujitsu.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'kernel/trace')
| -rw-r--r-- | kernel/trace/trace_events_filter.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c index 22c29984fe0e..a7430b16d243 100644 --- a/kernel/trace/trace_events_filter.c +++ b/kernel/trace/trace_events_filter.c @@ -736,7 +736,7 @@ static inline void clear_operand_string(struct filter_parse_state *ps) static inline int append_operand_char(struct filter_parse_state *ps, char c) { - if (ps->operand.tail == MAX_FILTER_STR_VAL) + if (ps->operand.tail == MAX_FILTER_STR_VAL - 1) return -EINVAL; ps->operand.string[ps->operand.tail++] = c; |