diff options
| author | Igor Kozhukhov <[email protected]> | 2016-06-15 14:28:36 -0700 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2016-06-28 13:47:03 -0700 |
| commit | eca7b76001a7d33f78bd98884aef8325bdbf98e7 (patch) | |
| tree | bdcd0489c5a6c7840258c4c6063c9a4903bec256 /module/zfs/dsl_deleg.c | |
| parent | 43e52eddb13d8accbd052fac9a242ce979531aa4 (diff) | |
OpenZFS 6314 - buffer overflow in dsl_dataset_name
Reviewed by: George Wilson <[email protected]>
Reviewed by: Prakash Surya <[email protected]>
Reviewed by: Igor Kozhukhov <[email protected]>
Approved by: Dan McDonald <[email protected]>
Ported-by: Brian Behlendorf <[email protected]>
OpenZFS-issue: https://www.illumos.org/issues/6314
OpenZFS-commit: https://github.com/openzfs/openzfs/commit/d6160ee
Diffstat (limited to 'module/zfs/dsl_deleg.c')
| -rw-r--r-- | module/zfs/dsl_deleg.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/module/zfs/dsl_deleg.c b/module/zfs/dsl_deleg.c index 952422be2..eb39cff57 100644 --- a/module/zfs/dsl_deleg.c +++ b/module/zfs/dsl_deleg.c @@ -20,7 +20,7 @@ */ /* * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. - * Copyright (c) 2011, 2014 by Delphix. All rights reserved. + * Copyright (c) 2011, 2015 by Delphix. All rights reserved. */ /* @@ -330,7 +330,7 @@ dsl_deleg_get(const char *ddname, nvlist_t **nvp) za = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP); basezc = kmem_alloc(sizeof (zap_cursor_t), KM_SLEEP); baseza = kmem_alloc(sizeof (zap_attribute_t), KM_SLEEP); - source = kmem_alloc(MAXNAMELEN + strlen(MOS_DIR_NAME) + 1, KM_SLEEP); + source = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP); VERIFY(nvlist_alloc(nvp, NV_UNIQUE_NAME, KM_SLEEP) == 0); for (dd = startdd; dd != NULL; dd = dd->dd_parent) { @@ -370,7 +370,7 @@ dsl_deleg_get(const char *ddname, nvlist_t **nvp) nvlist_free(sp_nvp); } - kmem_free(source, MAXNAMELEN + strlen(MOS_DIR_NAME) + 1); + kmem_free(source, ZFS_MAX_DATASET_NAME_LEN); kmem_free(baseza, sizeof (zap_attribute_t)); kmem_free(basezc, sizeof (zap_cursor_t)); kmem_free(za, sizeof (zap_attribute_t)); |