diff options
| author | NeilBrown <neilb@suse.de> | 2008-02-26 13:57:39 -0500 |
|---|---|---|
| committer | Steve Dickson <steved@redhat.com> | 2008-02-26 13:57:39 -0500 |
| commit | bcd0fcaf0966c546da5043be700587f73174ae25 (patch) | |
| tree | f88b73f4428d39113af5aaed1984015a9171c6ae /utils/idmapd | |
| parent | acf95d32a44fd8357c24e8a04ec53fc6900bfc58 (diff) | |
| download | nfs-utils-bcd0fcaf0966c546da5043be700587f73174ae25.tar.gz nfs-utils-bcd0fcaf0966c546da5043be700587f73174ae25.tar.xz nfs-utils-bcd0fcaf0966c546da5043be700587f73174ae25.zip | |
If validateascii is passed a string containing only non-zero 7bit
values, then the loop with exit with i == len, and the following
test will access beyond the end of the array.
So add an extra test to fix this.
Found by Marcus Meissner <meissner@novell.com>.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
Diffstat (limited to 'utils/idmapd')
| -rw-r--r-- | utils/idmapd/idmapd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/utils/idmapd/idmapd.c b/utils/idmapd/idmapd.c index 355c6e1..6b5971c 100644 --- a/utils/idmapd/idmapd.c +++ b/utils/idmapd/idmapd.c @@ -848,7 +848,7 @@ validateascii(char *string, u_int32_t len) return (-1); } - if (string[i] != '\0') + if ((i >= len) || string[i] != '\0') return (-1); return (i + 1); |