Don't leak process-private data on Change Local Name command.
The Change Local Name command to the controller doesn't zero out the contents of the command buffer before setting the contents. As a result, the controller sees both the new device name and then random data left over on the heap from previous operations. This random data may contain sensitive information. Although the device name is null-terminated, a controller may inadvertently leak the additional information over the network. This change fixes the behaviour by zeroing out the entire command buffer before copying the device name into it. If the device name doesn't occupy the entire buffer, the rest of it will be zero. http://b/12949068 Change-Id: I4dd6ce6dd6709589fcd1e23f974db820820bc8e1
Loading
Please register or sign in to comment