From: Fedor Tokarev Date: Sat, 28 Mar 2020 11:56:55 +0000 (+0300) Subject: net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' X-Git-Tag: v5.4.49~117 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=5e85d78ed4ffa94066fb32e59f0e4e59622f7de2;p=platform%2Fkernel%2Flinux-rpi.git net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' [ Upstream commit 118917d696dc59fd3e1741012c2f9db2294bed6f ] Fix off-by-one issues in 'rpc_ntop6': - 'snprintf' returns the number of characters which would have been written if enough space had been available, excluding the terminating null byte. Thus, a return value of 'sizeof(scopebuf)' means that the last character was dropped. - 'strcat' adds a terminating null byte to the string, thus if len == buflen, the null byte is written past the end of the buffer. Signed-off-by: Fedor Tokarev Signed-off-by: Anna Schumaker Signed-off-by: Sasha Levin --- diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c index d024af4..105d17a 100644 --- a/net/sunrpc/addr.c +++ b/net/sunrpc/addr.c @@ -82,11 +82,11 @@ static size_t rpc_ntop6(const struct sockaddr *sap, rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u", IPV6_SCOPE_DELIMITER, sin6->sin6_scope_id); - if (unlikely((size_t)rc > sizeof(scopebuf))) + if (unlikely((size_t)rc >= sizeof(scopebuf))) return 0; len += rc; - if (unlikely(len > buflen)) + if (unlikely(len >= buflen)) return 0; strcat(buf, scopebuf);