iscsi-target: fix extract_param to handle buffer length corner case
authorEric Seppanen <eric@purestorage.com>
Wed, 20 Nov 2013 22:19:51 +0000 (14:19 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 4 Dec 2013 18:56:15 +0000 (10:56 -0800)
commite97f132f0e66893138f64b681cddff2d2ff37b53
treeaad150522af32dc3c9de4bfa81ffd6f807e11ade
parentcf516effc76c78f948e6eb7cc46d4515003b423d
iscsi-target: fix extract_param to handle buffer length corner case

commit 369653e4fb511928511b0ce81f41c812ff1f28b6 upstream.

extract_param() is called with max_length set to the total size of the
output buffer.  It's not safe to allow a parameter length equal to the
buffer size as the terminating null would be written one byte past the
end of the output buffer.

Signed-off-by: Eric Seppanen <eric@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/target/iscsi/iscsi_target_nego.c