提交 0597d1b9 编写于 作者: O Oliver Hartkopp 提交者: David S. Miller

can-bcm: fix minor heap overflow

On 64-bit platforms the ASCII representation of a pointer may be up to 17
bytes long. This patch increases the length of the buffer accordingly.

http://marc.info/?l=linux-netdev&m=128872251418192&w=2Reported-by: NDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: NOliver Hartkopp <socketcan@hartkopp.net>
CC: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 6c4f1994
...@@ -125,7 +125,7 @@ struct bcm_sock { ...@@ -125,7 +125,7 @@ struct bcm_sock {
struct list_head tx_ops; struct list_head tx_ops;
unsigned long dropped_usr_msgs; unsigned long dropped_usr_msgs;
struct proc_dir_entry *bcm_proc_read; struct proc_dir_entry *bcm_proc_read;
char procname [9]; /* pointer printed in ASCII with \0 */ char procname [20]; /* pointer printed in ASCII with \0 */
}; };
static inline struct bcm_sock *bcm_sk(const struct sock *sk) static inline struct bcm_sock *bcm_sk(const struct sock *sk)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册