iscsi-target: fix extract_param to handle buffer length corner case
authorEric Seppanen <eric@purestorage.com>
Wed, 20 Nov 2013 22:19:51 +0000 (14:19 -0800)
committerBen Hutchings <ben@decadent.org.uk>
Fri, 3 Jan 2014 04:33:23 +0000 (04:33 +0000)
commit6d8fcca06072afed5d917c980ac233abd4f03e0b
tree9edbfbe0291ee9b74ebafe06005ef57038ccf98b
parent3bf4e8c8072d395099cde6f6f84b69ea015b70d8
iscsi-target: fix extract_param to handle buffer length corner case

commit 369653e4fb511928511b0ce81f41c812ff1f28b6 upstream.

extract_param() is called with max_length set to the total size of the
output buffer.  It's not safe to allow a parameter length equal to the
buffer size as the terminating null would be written one byte past the
end of the output buffer.

Signed-off-by: Eric Seppanen <eric@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/target/iscsi/iscsi_target_nego.c