History

sysctl: fix null checking in bin_dn_node_address()

The null check of `strchr() + 1' is broken, which is always non-null, leading to OOB read. Instead, check the result of strchr().

Xi Wang committed 13 years ago

Commit df1778b1 parent ac2e5321 file · +2 −1Browse files

Showing the changes to kernel/sysctl_binary.c (1 of 1 file). Show all

Unified · Split

kernel/sysctl_binary.c+2−1
@@ -1171,9 +1171,10 @@ static ssize_t bin_dn_node_address(struct file *file, · 1170 unmodified lines
1171 1171
1172 /* Convert the decnet address to binary */1172 /* Convert the decnet address to binary */
1173 result = -EIO;1173 result = -EIO;
1174 nodep = strchr(buf, '.') + 1;1174 nodep = strchr(buf, '.');
1175 if (!nodep)1175 if (!nodep)
1176 goto out;1176 goto out;
1177 ++nodep;
1177 1178
1178 area = simple_strtoul(buf, NULL, 10);1179 area = simple_strtoul(buf, NULL, 10);
1179 node = simple_strtoul(nodep, NULL, 10);1180 node = simple_strtoul(nodep, NULL, 10);