Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] Fix a buffer overflow in qword_add()
To:     trondmy@kernel.org
Cc:     linux-nfs@vger.kernel.org
References: <20200416213453.80110-1-trondmy@kernel.org>
From:   Steve Dickson <SteveD@RedHat.com>
Message-ID: <9a49fcea-2576-e345-2450-6411e45e022f@RedHat.com>
Date:   Fri, 8 May 2020 10:10:45 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.5.0
MIME-Version: 1.0
In-Reply-To: <20200416213453.80110-1-trondmy@kernel.org>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk


On 4/16/20 5:34 PM, trondmy@kernel.org wrote:
> From: Trond Myklebust <trond.myklebust@hammerspace.com>
> 
> Don't allow writing beyond the end of the buffer.
> 
> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Committed... (tag: nfs-utils-2-4-4-rc4)

steved.

> ---
>  support/nfs/cacheio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/support/nfs/cacheio.c b/support/nfs/cacheio.c
> index 126c12831668..70ead94d64f0 100644
> --- a/support/nfs/cacheio.c
> +++ b/support/nfs/cacheio.c
> @@ -42,7 +42,7 @@ void qword_add(char **bpp, int *lp, char *str)
>  
>  	if (len < 0) return;
>  
> -	while ((c=*str++) && len)
> +	while ((c=*str++) && len > 0)
>  		switch(c) {
>  		case ' ':
>  		case '\t':
>