Commit 0597d1b9 authored Nov 10, 2010 by Oliver Hartkopp Committed by David S. Miller Nov 12, 2010

can-bcm: fix minor heap overflow

On 64-bit platforms the ASCII representation of a pointer may be up to 17
bytes long. This patch increases the length of the buffer accordingly.

http://marc.info/?l=linux-netdev&m=128872251418192&w=2



Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
CC: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 6c4f1994

net/can/bcm.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -125,7 +125,7 @@ struct bcm_sock {
	struct list_head tx_ops;		struct list_head tx_ops;
	unsigned long dropped_usr_msgs;		unsigned long dropped_usr_msgs;
	struct proc_dir_entry *bcm_proc_read;		struct proc_dir_entry *bcm_proc_read;
	char procname [9]; /* pointer printed in ASCII with \0 */		char procname [20]; /* pointer printed in ASCII with \0 */
	};		};

	static inline struct bcm_sock bcm_sk(const struct sock sk)		static inline struct bcm_sock bcm_sk(const struct sock sk)