ff0102ee10
'discovery->data.info' length is 22, NICKNAME_MAX_LEN is 21, so the strncpy() will always left the last byte of 'discovery->data.info' uninitialized. When 'text' length is longer than 21 (NICKNAME_MAX_LEN), if still left the last byte of 'discovery->data.info' uninitialized, the next strlen() will cause issue. Also 'discovery->data' is 'struct irda_device_info' which defined in "include/uapi/...", it may copy to user mode, so need whole initialized. All together, need use kzalloc() instead of kmalloc() to initialize all members firstly. Signed-off-by: Chen Gang <gang.chen@asianux.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| ircomm | ||
| irlan | ||
| irnet | ||
| Kconfig | ||
| Makefile | ||
| af_irda.c | ||
| discovery.c | ||
| irda_device.c | ||
| iriap.c | ||
| iriap_event.c | ||
| irias_object.c | ||
| irlap.c | ||
| irlap_event.c | ||
| irlap_frame.c | ||
| irlmp.c | ||
| irlmp_event.c | ||
| irlmp_frame.c | ||
| irmod.c | ||
| irnetlink.c | ||
| irproc.c | ||
| irqueue.c | ||
| irsysctl.c | ||
| irttp.c | ||
| parameters.c | ||
| qos.c | ||
| timer.c | ||
| wrapper.c | ||