Staging: bcm: copying more data than intended

PATCH New Dan Carpenter 1 participant 1 message Jan 9, 2013

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2013-01-09 07:09 UTC #0 lore raw

PATCH 1/1 Staging: bcm: copying more data than intended

This was changed to bcm_flash2x_cs_info instead of bcm_flash_cs_info when we got rid of the typedefs. bcm_flash2x_cs_info is quite a bit larger than bcm_flash_cs_info (436 bytes instead of 96) so it would corrupt user memory and it's an info leak.

Signed-off-by Dan Carpenter <[email protected]>

---
Only needed in linux-next. I'm not sure how I missed this when the patch was originally submitted. I reviewed the patchset.

drivers/staging/bcm/Bcmchar.c +1 -1

index 4ba1a5d..491e2bf 100644
@@ -1792,7 +1792,7 @@ cntrlEnd:
 			if (IoBuffer.OutputLength < sizeof(struct bcm_flash_cs_info))
 				return -EINVAL;
 
-			if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash2x_cs_info)))
+			if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash_cs_info)))
 				return -EFAULT;
 		}
 	}