From: Daniel Wagner <dwagner@suse.de>
Date: Fri, 27 Jan 2023 09:28:49 +0000 (+0100)
Subject: fabrics: Avoid buffer overrun in strchomp
X-Git-Tag: v1.3~3^2
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=c4a91b6afae12b09d72a6da25e7033e2680a600a;p=users%2Fsagi%2Flibnvme.git

fabrics: Avoid buffer overrun in strchomp

strchomp() has an off-by-one error and starts stripping spaces at the
byte AFTER the end of the buffer.

Signed-off-by: Daniel Wagner <dwagner@suse.de>
---

diff --git a/src/nvme/fabrics.c b/src/nvme/fabrics.c
index 0e8e9dc1..7134dbae 100644
--- a/src/nvme/fabrics.c
+++ b/src/nvme/fabrics.c
@@ -47,13 +47,19 @@ const char *nvmf_dev = "/dev/nvme-fabrics";
 
 /**
  * strchomp() - Strip trailing white space
- * @s: String to strip
- * @l: Maximum length of string
+ * @str: String to strip
+ * @max: Maximum length of string
  */
-static void strchomp(char *s, int l)
+static void strchomp(char *str, int max)
 {
-	while (l && (s[l] == '\0' || s[l] == ' '))
-		s[l--] = '\0';
+	int i;
+
+	for (i = max - 1; i >= 0; i--) {
+		if (str[i] != '\0' && str[i] != ' ')
+			return;
+		else
+			str[i] = '\0';
+	}
 }
 
 const char *arg_str(const char * const *strings,