[linux-next] LinuxNextTracking branch, master, updated. next-20130513

batman at open-mesh.org batman at open-mesh.org
Tue May 14 00:17:17 CEST 2013


The following commit has been merged in the master branch:
commit 293c9c1cef6be46ad72b528fa79c3ff034551fe0
Author: Marek Lindner <lindner_marek at yahoo.de>
Date:   Sat Apr 27 16:22:28 2013 +0800

    batman-adv: check proto length before accessing proto string buffer
    
    batadv_param_set_ra() strips the trailing '\n' from the supplied
    string buffer without checking the length of the buffer first. This
    patches avoids random memory access and associated potential
    crashes.
    
    Reported-by: Sasha Levin <sasha.levin at oracle.com>
    Signed-off-by: Marek Lindner <lindner_marek at yahoo.de>
    Signed-off-by: Antonio Quartulli <ordex at autistici.org>

diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 3e30a0f..9c620cd 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp)
 	char *algo_name = (char *)val;
 	size_t name_len = strlen(algo_name);
 
-	if (algo_name[name_len - 1] == '\n')
+	if (name_len > 0 && algo_name[name_len - 1] == '\n')
 		algo_name[name_len - 1] = '\0';
 
 	bat_algo_ops = batadv_algo_get(algo_name);

-- 
LinuxNextTracking


More information about the linux-merge mailing list