redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

staging: dgrp: info leak in dgrp_dpa_ioctl()

Browse source 
If "nd->nd_vpd_len" is less than 512 then the last part of the
"vpd.vpd_data" has uninitialized stack information.  We need to clear it
before copying the buffer to user space.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2013-04-21 14:08:31 +03:00 committed by Greg Kroah-Hartman
parent a4b47eeac2
commit eecb262922
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
drivers/staging/dgrp/dgrp_dpa_ops.c
View file

@ -432,6 +432,7 @@ static long dgrp_dpa_ioctl(struct file *file, unsigned int cmd,
case DIGI_GETVPD:
memset(&vpd, 0, sizeof(vpd));
if (nd->nd_vpd_len > 0) {
vpd.vpd_len = nd->nd_vpd_len;
memcpy(&vpd.vpd_data, &nd->nd_vpd, nd->nd_vpd_len);