Skip to contentSkip to conversation

Bluetooth: Fix out of scope variable access in hci_sock_cmsg()

PATCH In review Johann Felix Soden 2 participants 2 messages Feb 15, 2010 – Feb 17, 2010

Subsystems (2)
Bluetooth drivers Bluetooth
lore
Share & tools
lore

Johann Felix Soden

author
#0 lore raw

PATCH 1/1 Bluetooth: Fix out of scope variable access in hci_sock_cmsg()

From: Johann Felix Soden <[email protected]>

The pointer data can point to the variable ctv. Access to data happens when ctv is already out of scope.

Signed-off-by Johann Felix Soden <[email protected]>
---
 net/bluetooth/hci_sock.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
net/bluetooth/hci_sock.c +1 -1
index 688cfeb..b0e6108 100644
@@ -338,8 +338,8 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
 		data = &tv;
 		len = sizeof(tv);
 #ifdef CONFIG_COMPAT
+		struct compat_timeval ctv;
 		if (msg->msg_flags & MSG_CMSG_COMPAT) {
-			struct compat_timeval ctv;
 			ctv.tv_sec = tv.tv_sec;
 			ctv.tv_usec = tv.tv_usec;
 			data = &ctv;
Signature · 1 line
1.6.6.2
maintainer
#1 lore raw

Hi Johann,

Quoted 2 lines

The pointer data can point to the variable ctv. Access to data happens when ctv is already out of scope.

patch has been applied to my bluetooth-2.6 tree.

Regards

Marcel