Commit cf9b94f8 authored Sep 04, 2010 by Dan Carpenter Committed by David S. Miller Sep 07, 2010

irda: off by one



This is an off by one.  We would go past the end when we NUL terminate
the "value" string at end of the function.  The "value" buffer is
allocated in irlan_client_parse_response() or
irlan_provider_parse_command().

CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 89b12fab

net/irda/irlan/irlan_common.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1102,7 +1102,7 @@ int irlan_extract_param(__u8 buf, char name, char value, __u16 len)
		memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */
		le16_to_cpus(&val_len); n+=2;

		if (val_len > 1016) {
		if (val_len >= 1016) {
		IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ );
		return -RSP_INVALID_COMMAND_FORMAT;
		}