提交 3af70613 编写于 作者: D Dan Carpenter 提交者: J. Bruce Fields

nfsd4: memory corruption in numeric_name_to_id()

"id" is type is a uid_t (32 bits) but on 64 bit systems strict_strtoul()
modifies 64 bits of data.  We should use kstrtouint() instead.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>
上级 92769108
...@@ -581,7 +581,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel ...@@ -581,7 +581,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
/* Just to make sure it's null-terminated: */ /* Just to make sure it's null-terminated: */
memcpy(buf, name, namelen); memcpy(buf, name, namelen);
buf[namelen] = '\0'; buf[namelen] = '\0';
ret = strict_strtoul(name, 10, (unsigned long *)id); ret = kstrtouint(name, 10, id);
return ret == 0; return ret == 0;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册