ipr: Fix out-of-bounds null overwrite
authorInsu Yun <wuninsu@gmail.com>
Wed, 6 Jan 2016 17:44:01 +0000 (12:44 -0500)
committerWilly Tarreau <w@1wt.eu>
Tue, 7 Jun 2016 08:42:47 +0000 (10:42 +0200)
commitc7f5b11ef43abc9e274cf664311ff7bcf5d76cd6
tree04776dc0e06faf40cc36fec6e6d5bdec521faf03
parent7af534dea77d1c526b83a4105178e1a79da09811
ipr: Fix out-of-bounds null overwrite

commit d63c7dd5bcb9441af0526d370c43a65ca2c980d9 upstream.

Return value of snprintf is not bound by size value, 2nd argument.
(https://www.kernel.org/doc/htmldocs/kernel-api/API-snprintf.html).
Return value is number of printed chars, can be larger than 2nd
argument.  Therefore, it can write null byte out of bounds ofbuffer.
Since snprintf puts null, it does not need to put additional null byte.

Signed-off-by: Insu Yun <wuninsu@gmail.com>
Reviewed-by: Shane Seymour <shane.seymour@hpe.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/scsi/ipr.c