orangefs: off by ones in xattr size checks
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 22 May 2017 12:08:31 +0000 (15:08 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 10 Nov 2018 15:42:46 +0000 (07:42 -0800)
commit0da0e51729959e047e2e6f4a8e3554826b8cc607
tree2d9715add7a7bb123bd19c80654dec87af91c445
parent01acd933d6184a7626f5e0dac1ad0cb794aa74a5
orangefs: off by ones in xattr size checks

[ Upstream commit 5f13e58767a53ebb54265e03c0c4a67650286263 ]

A previous patch which claimed to remove off by ones actually introduced
them.

strlen() returns the length of the string not including the NUL
character.  We are using strcpy() to copy "name" into a buffer which is
ORANGEFS_MAX_XATTR_NAMELEN characters long.  We should make sure to
leave space for the NUL, otherwise we're writing one character beyond
the end of the buffer.

Fixes: e675c5ec51fe ("orangefs: clean up oversize xattr validation")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/orangefs/xattr.c