]> git.baikalelectronics.ru Git - kernel.git/commit
Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
authorColin Ian King <colin.king@canonical.com>
Wed, 4 Aug 2021 15:09:51 +0000 (16:09 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Sep 2021 07:47:33 +0000 (09:47 +0200)
commit277070d9430aa7b6f02b8c6228d7835f7363fed7
tree305efb1d2f1e9b41bd4bbb5f948989da8aab32db
parent5685a2b62740e1cd01e374c537128e956db7cbbf
Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow

[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ]

An earlier commit replaced using batostr to using %pMR sprintf for the
construction of session->name. Static analysis detected that this new
method can use a total of 21 characters (including the trailing '\0')
so we need to increase the BTNAMSIZ from 18 to 21 to fix potential
buffer overflows.

Addresses-Coverity: ("Out-of-bounds write")
Fixes: ab2d4165f8a9 ("Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/bluetooth/cmtp/cmtp.h