diff options
| -rw-r--r-- | net/unix/af_unix.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 0768f8814759..20165335e27b 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -188,6 +188,13 @@ static int unix_mkname(struct sockaddr_un * sunaddr, int len, unsigned *hashp) if (!sunaddr || sunaddr->sun_family != AF_UNIX) return -EINVAL; if (sunaddr->sun_path[0]) { + /* + * This may look like an off by one error but it is a bit more + * subtle. 108 is the longest valid AF_UNIX path for a binding. + * sun_path[108] doesnt as such exist. However in kernel space + * we are guaranteed that it is a valid memory location in our + * kernel address buffer. + */ ((char *)sunaddr)[len]=0; len = strlen(sunaddr->sun_path)+1+sizeof(short); return len; |