luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nfsd4: memory corruption in numeric_name_to_id()

Browse Source 
"id" is type is a uid_t (32 bits) but on 64 bit systems strict_strtoul()
modifies 64 bits of data.  We should use kstrtouint() instead.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
Dan Carpenter 2012-03-28 13:44:59 +03:00 committed by J. Bruce Fields
parent 92769108f5
commit 3af706135b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/nfsd/nfs4idmap.c
View File

@ -581,7 +581,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
/* Just to make sure it's null-terminated: */ /* Just to make sure it's null-terminated: */
memcpy(buf, name, namelen); memcpy(buf, name, namelen);
buf[namelen] = '\0'; buf[namelen] = '\0';
ret = strict_strtoul(name, 10, (unsigned long *)id); ret = kstrtouint(name, 10, id);
return ret == 0; return ret == 0;
} }