Commit 81904dbb authored Feb 25, 2016 by Linus Torvalds

linux

Pull nfsd bugfix from Bruce Fields:
 "One fix for a bug that could cause a NULL write past the end of a
  buffer in case of unusually long writes to some system interfaces used
  by mountd and other nfs support utilities"

* tag 'nfsd-4.5-1' of git://linux-nfs.org/~bfields/linux:
  sunrpc/cache: fix off-by-one in qword_get()

parents 3acdb84c b7052cd7

net/sunrpc/cache.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1225,7 +1225,7 @@ int qword_get(char *bpp, char dest, int bufsize)
		if (bp[0] == '\\' && bp[1] == 'x') {
		/* HEX STRING */
		bp += 2;
		while (len < bufsize) {
		while (len < bufsize - 1) {
		int h, l;

		h = hex_to_bin(bp[0]);