iscsi-target: fix extract_param to handle buffer length corner case
authorEric Seppanen <eric@purestorage.com>
Wed, 20 Nov 2013 22:19:51 +0000 (14:19 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 4 Dec 2013 19:05:23 +0000 (11:05 -0800)
commit9457444765ff2125c970a92011f24f1eb20e75cc
tree1d547b58d6486768ed0a4516d5dc773845ef1c91
parent82452e2aa3fa08c0851c5fbcdbecb17ba271c0e6
iscsi-target: fix extract_param to handle buffer length corner case

commit 369653e4fb511928511b0ce81f41c812ff1f28b6 upstream.

extract_param() is called with max_length set to the total size of the
output buffer.  It's not safe to allow a parameter length equal to the
buffer size as the terminating null would be written one byte past the
end of the output buffer.

Signed-off-by: Eric Seppanen <eric@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/target/iscsi/iscsi_target_nego.c