Thre is potential buffer overflow in iscsi_session_alloc() due to

short computation of needed string size.  Notice the "%s@%s" in the first call
to sprintf().

Signed-off-by: David Butterfield <dab21774@gmail.com>



git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7110 d57e44dd-8a1f-0410-8b47-8ef2f437770f

iscsi-scst/kernel/session.c

@@ -65,7 +65,7 @@ static int iscsi_session_alloc(struct iscsi_target *target,
 
 #ifdef CONFIG_SCST_PROC
 	name = kmalloc(strlen(info->user_name) + strlen(info->initiator_name) +
-			1, GFP_KERNEL);
+			2, GFP_KERNEL);	/* +1 (for '\0') +1 (for '@') */
 	if (name == NULL) {
 		err = -ENOMEM;
 		goto err;