Commit df1778be authored Feb 27, 2013 by Xi Wang Committed by Linus Torvalds Feb 27, 2013

sysctl: fix null checking in bin_dn_node_address()

The null check of `strchr() + 1' is broken, which is always non-null,
leading to OOB read.  Instead, check the result of strchr().

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent ac2e5327

kernel/sysctl_binary.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1171,9 +1171,10 @@ static ssize_t bin_dn_node_address(struct file *file,

		/* Convert the decnet address to binary */
		result = -EIO;
		nodep = strchr(buf, '.') + 1;
		nodep = strchr(buf, '.');
		if (!nodep)
		goto out;
		++nodep;

		area = simple_strtoul(buf, NULL, 10);
		node = simple_strtoul(nodep, NULL, 10);