diff options
| author | Vasiliy Kulikov <segoon@openwall.com> | 2011-02-14 10:54:31 (GMT) |
|---|---|---|
| committer | Gustavo F. Padovan <padovan@profusion.mobi> | 2011-02-14 14:51:33 (GMT) |
| commit | 43629f8f5ea32a998d06d1bb41eefa0e821ff573 (patch) | |
| tree | 6cc475d80311abf2b06e2b8a2cfd96043192decd /net/bluetooth/bnep | |
| parent | d9f51b51db2064c9049bf7924318fd8c6ed852cb (diff) | |
| download | linux-43629f8f5ea32a998d06d1bb41eefa0e821ff573.tar.xz | |
Bluetooth: bnep: fix buffer overflow
Struct ca is copied from userspace. It is not checked whether the "device"
field is NULL terminated. This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Diffstat (limited to 'net/bluetooth/bnep')
| -rw-r--r-- | net/bluetooth/bnep/sock.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c index 2862f53..d935da7 100644 --- a/net/bluetooth/bnep/sock.c +++ b/net/bluetooth/bnep/sock.c @@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long sockfd_put(nsock); return -EBADFD; } + ca.device[sizeof(ca.device)-1] = 0; err = bnep_add_connection(&ca, nsock); if (!err) { |