diff options
| author | Vasiliy Kulikov <segoon@openwall.com> | 2011-02-14 13:54:31 +0300 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2011-04-30 16:53:29 +0200 |
| commit | 592de25b7baa8c7e7005b1d6e4b693774b4a6ab5 (patch) | |
| tree | a8b665d91de3f21b38cba067192dde32605720b4 | |
| parent | 9d22ccdc6c1da8ec119b939d5d0b4cc76b23b286 (diff) | |
Bluetooth: bnep: fix buffer overflow
commit 43629f8f5ea32a998d06d1bb41eefa0e821ff573 upstream.
Struct ca is copied from userspace. It is not checked whether the "device"
field is NULL terminated. This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | net/bluetooth/bnep/sock.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c index 8ffb57f2303..9a04d137972 100644 --- a/net/bluetooth/bnep/sock.c +++ b/net/bluetooth/bnep/sock.c @@ -93,6 +93,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long sockfd_put(nsock); return -EBADFD; } + ca.device[sizeof(ca.device)-1] = 0; err = bnep_add_connection(&ca, nsock); if (!err) { |