Re: Off-by-one bug at unix_mkname ?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



In article <[email protected]> (at Mon, 28 Mar 2005 17:21:08 +0900 (JST)), YOSHIFUJI Hideaki / 吉藤英明 <[email protected]> says:

> > It seems to me that the following code is off-by-one bug.
:
> Well, 2.2 has some comment on this:

So, I'd suggest to put the comment back to 2.4/2.6 instead.
(Note: net/socket.c refers this around MAX_SOCK_ADDR definition.)

Signed-off-by: Hideaki YOSHIFUJI <[email protected]>

===== net/unix/af_unix.c 1.73 vs edited =====
--- 1.73/net/unix/af_unix.c	2005-03-10 13:42:53 +09:00
+++ edited/net/unix/af_unix.c	2005-03-28 17:31:33 +09:00
@@ -188,6 +188,15 @@
 	if (!sunaddr || sunaddr->sun_family != AF_UNIX)
 		return -EINVAL;
 	if (sunaddr->sun_path[0]) {
+		/*
+		 *	This may look like an off by one error but it is
+		 *	a bit more subtle. 108 is the longest valid AF_UNIX
+		 *	path for a binding. sun_path[108] doesnt as such
+		 *	exist. However in kernel space we are guaranteed that
+		 *	it is a valid memory location in our kernel
+		 *	address buffer.
+		 */
+		if (len > sizeof(*sunaddr))
 		((char *)sunaddr)[len]=0;
 		len = strlen(sunaddr->sun_path)+1+sizeof(short);
 		return len;

-- 
Hideaki YOSHIFUJI @ USAGI Project <[email protected]>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]
  Powered by Linux