mirror of
https://github.com/torvalds/linux
synced 2024-09-06 09:51:23 +00:00
net: sunrpc: Fix off-by-one issues in 'rpc_ntop6'
Fix off-by-one issues in 'rpc_ntop6': - 'snprintf' returns the number of characters which would have been written if enough space had been available, excluding the terminating null byte. Thus, a return value of 'sizeof(scopebuf)' means that the last character was dropped. - 'strcat' adds a terminating null byte to the string, thus if len == buflen, the null byte is written past the end of the buffer. Signed-off-by: Fedor Tokarev <ftokarev@gmail.com> Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
This commit is contained in:
parent
00a7a00e2d
commit
118917d696
|
@ -82,11 +82,11 @@ static size_t rpc_ntop6(const struct sockaddr *sap,
|
|||
|
||||
rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u",
|
||||
IPV6_SCOPE_DELIMITER, sin6->sin6_scope_id);
|
||||
if (unlikely((size_t)rc > sizeof(scopebuf)))
|
||||
if (unlikely((size_t)rc >= sizeof(scopebuf)))
|
||||
return 0;
|
||||
|
||||
len += rc;
|
||||
if (unlikely(len > buflen))
|
||||
if (unlikely(len >= buflen))
|
||||
return 0;
|
||||
|
||||
strcat(buf, scopebuf);
|
||||
|
|
Loading…
Reference in a new issue