Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 37f9fc45 authored by Samuel Ortiz's avatar Samuel Ortiz Committed by Samuel Ortiz
Browse files

irda: Fix heap memory corruption in iriap.c 



While parsing the GetValuebyClass command frame, we could potentially write
passed the skb->data pointer.

Cc: stable@kernel.org
Reported-by: default avatarIlja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: default avatarSamuel Ortiz <samuel@sortiz.org>
parent efc463eb

net/irda/iriap.c

+2 −1
Original line number Diff line number Diff line
@@ -502,6 +502,7 @@ static void iriap_getvaluebyclass_confirm(struct iriap_cb *self, 
		IRDA_DEBUG(4, "%s(), strlen=%d\n", __func__, value_len);



		/* Make sure the string is null-terminated */

		if (n + value_len < skb->len)

			fp[n + value_len] = 0x00;

		IRDA_DEBUG(4, "Got string %s\n", fp+n);