linux/lib/strnlen_user.c
Jan Kara 07789505d0 lib: Fix strnlen_user() to not touch memory after specified maximum
commit f18c34e483 upstream.

If the specified maximum length of the string is a multiple of unsigned
long, we would load one long behind the specified maximum.  If that
happens to be in a next page, we can hit a page fault although we were
not expected to.

Fix the off-by-one bug in the test whether we are at the end of the
specified range.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
2015-06-11 11:24:59 +01:00

139 lines
3.7 KiB