Skip to contentSkip to conversation

irda: off by one

PATCH Applied Dan Carpenter 2 participants 2 messages Sep 4, 2010 – Sep 7, 2010

Subsystems (3)
Networking Network drivers Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 irda: off by one

This is an off by one. We would go past the end when we NUL terminate the "value" string at end of the function. The "value" buffer is allocated in irlan_client_parse_response() or irlan_provider_parse_command().

CC [email protected]
Signed-off-by Dan Carpenter <[email protected]>
net/irda/irlan/irlan_common.c +1 -1
index a788f9e..6130f9d 100644
@@ -1102,7 +1102,7 @@ int irlan_extract_param(__u8 *buf, char *name, char *value, __u16 *len)
 	memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */
 	le16_to_cpus(&val_len); n+=2;
 
-	if (val_len > 1016) {
+	if (val_len >= 1016) {
 		IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ );
 		return -RSP_INVALID_COMMAND_FORMAT;
 	}