lkml.org 
[lkml]   [2010]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[36/59] isdn: fix information leak
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------


    From: Dan Carpenter <error27@gmail.com>

    [ Upstream commit 4b030d4288a569d6bdeca884d7f102d951f097f2 ]

    The main motivation of this patch changing strcpy() to strlcpy().
    We strcpy() to copy a 48 byte buffers into a 49 byte buffers. So at
    best the last byte has leaked information, or maybe there is an
    overflow? Anyway, this patch closes the information leaks by zeroing
    the memory and the calls to strlcpy() prevent overflows.

    Signed-off-by: Dan Carpenter <error27@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ---
    drivers/isdn/sc/ioctl.c | 10 +++++-----
    1 file changed, 5 insertions(+), 5 deletions(-)

    --- a/drivers/isdn/sc/ioctl.c
    +++ b/drivers/isdn/sc/ioctl.c
    @@ -174,7 +174,7 @@ int sc_ioctl(int card, scs_ioctl *data)
    pr_debug("%s: SCIOGETSPID: ioctl received\n",
    sc_adapter[card]->devicename);

    - spid = kmalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
    + spid = kzalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
    if (!spid) {
    kfree(rcvmsg);
    return -ENOMEM;
    @@ -194,7 +194,7 @@ int sc_ioctl(int card, scs_ioctl *data)
    kfree(rcvmsg);
    return status;
    }
    - strcpy(spid, rcvmsg->msg_data.byte_array);
    + strlcpy(spid, rcvmsg->msg_data.byte_array, SCIOC_SPIDSIZE);

    /*
    * Package the switch type and send to user space
    @@ -272,12 +272,12 @@ int sc_ioctl(int card, scs_ioctl *data)
    return status;
    }

    - dn = kmalloc(SCIOC_DNSIZE, GFP_KERNEL);
    + dn = kzalloc(SCIOC_DNSIZE, GFP_KERNEL);
    if (!dn) {
    kfree(rcvmsg);
    return -ENOMEM;
    }
    - strcpy(dn, rcvmsg->msg_data.byte_array);
    + strlcpy(dn, rcvmsg->msg_data.byte_array, SCIOC_DNSIZE);
    kfree(rcvmsg);

    /*
    @@ -348,7 +348,7 @@ int sc_ioctl(int card, scs_ioctl *data)
    pr_debug("%s: SCIOSTAT: ioctl received\n",
    sc_adapter[card]->devicename);

    - bi = kmalloc (sizeof(boardInfo), GFP_KERNEL);
    + bi = kzalloc(sizeof(boardInfo), GFP_KERNEL);
    if (!bi) {
    kfree(rcvmsg);
    return -ENOMEM;



    \
     
     \ /
      Last update: 2010-08-25 01:47    [W:0.040 / U:29.076 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site