]> git.baikalelectronics.ru Git - kernel.git/commit
Bluetooth: hidp: NUL terminate a string in the compat ioctl
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 16 May 2019 18:24:00 +0000 (21:24 +0300)
committerMarcel Holtmann <marcel@holtmann.org>
Sat, 6 Jul 2019 11:07:41 +0000 (13:07 +0200)
commit48f19cc986f4ee8c23f0bca32ae6f9f45aeba954
tree88c970ef166cff7817c2b060dc6bdfc711426532
parent1ccc23fe3e6770e6b2f89f9ebf535df18c6dec62
Bluetooth: hidp: NUL terminate a string in the compat ioctl

This change is similar to commit ef623f69ba32 ("Bluetooth: hidp: fix
buffer overflow") but for the compat ioctl.  We take a string from the
user and forgot to ensure that it's NUL terminated.

I have also changed the strncpy() in to strscpy() in hidp_setup_hid().
The difference is the strncpy() doesn't necessarily NUL terminate the
destination string.  Either change would fix the problem but it's nice
to take a belt and suspenders approach and do both.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
net/bluetooth/hidp/core.c
net/bluetooth/hidp/sock.c