projects / openwrt / staging / blogic.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: d9f51b5) | patch
Bluetooth: bnep: fix buffer overflow
authorVasiliy Kulikov <segoon@openwall.com>
Mon, 14 Feb 2011 10:54:31 +0000 (13:54 +0300)
committerGustavo F. Padovan <padovan@profusion.mobi>
Mon, 14 Feb 2011 14:51:33 +0000 (12:51 -0200)
commit43629f8f5ea32a998d06d1bb41eefa0e821ff573
tree6cc475d80311abf2b06e2b8a2cfd96043192decdtree | snapshot
parentd9f51b51db2064c9049bf7924318fd8c6ed852cbcommit | diff
Bluetooth: bnep: fix buffer overflow

Struct ca is copied from userspace.  It is not checked whether the "device"
field is NULL terminated.  This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
net/bluetooth/bnep/sock.c diff | blob | history
John Crispins staging tree