projects
/
firefly-linux-kernel-4.4.55.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
565af28
)
staging: comedi: fix infoleak to userspace
author
Vasiliy Kulikov
<segoon@openwall.com>
Sun, 26 Jun 2011 08:56:22 +0000
(12:56 +0400)
committer
Greg Kroah-Hartman
<gregkh@suse.de>
Fri, 5 Aug 2011 04:58:31 +0000
(21:58 -0700)
commit
819cbb120eaec7e014e5abd029260db1ca8c5735
upstream.
driver_name and board_name are pointers to strings, not buffers of size
COMEDI_NAMELEN. Copying COMEDI_NAMELEN bytes of a string containing
less than COMEDI_NAMELEN-1 bytes would leak some unrelated bytes.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/staging/comedi/comedi_fops.c
patch
|
blob
|
history
diff --git
a/drivers/staging/comedi/comedi_fops.c
b/drivers/staging/comedi/comedi_fops.c
index e7e72b8d8cdece8504f0adebc7279c135830f1fb..c20694e65157e00192223ebefffb2e0429a1689c 100644
(file)
--- a/
drivers/staging/comedi/comedi_fops.c
+++ b/
drivers/staging/comedi/comedi_fops.c
@@
-383,8
+383,8
@@
static int do_devinfo_ioctl(struct comedi_device *dev,
/* fill devinfo structure */
devinfo.version_code = COMEDI_VERSION_CODE;
devinfo.n_subdevs = dev->n_subdevices;
-
mem
cpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
-
mem
cpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
+
strl
cpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
+
strl
cpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
if (read_subdev)
devinfo.read_subdevice = read_subdev - dev->subdevices;