Commit 8020c16a authored Feb 28, 2011 by Szymon Janc Committed by Gustavo Padovan Mar 01, 2011

Bluetooth: Fix possible NULL pointer dereference in cmd_complete



It is now possible to create command complete event without specific
reply data by passing NULL as reply with len 0. Check pointer before
calling memcpy to avoid undefined behaviour.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

parent 30e76272

net/bluetooth/mgmt.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -92,6 +92,8 @@ static int cmd_complete(struct sock sk, u16 index, u16 cmd, void rp,

		ev = (void ) skb_put(skb, sizeof(ev) + rp_len);
		put_unaligned_le16(cmd, &ev->opcode);

		if (rp)
		memcpy(ev->data, rp, rp_len);

		if (sock_queue_rcv_skb(sk, skb) < 0)