mwave: info leak in mwave_ioctl()

PATCH New Dan Carpenter 1 participant 1 message Apr 15, 2013

Subsystems (2)

Kernel janitors Char and misc drivers

lore

Share & tools

lore

Dan Carpenter

author

2013-04-15 07:44 UTC #0 lore raw

PATCH 1/1 mwave: info leak in mwave_ioctl()

Smatch complains that on 64 bit systems, there is a hole in the MW_ABILITIES struct between ->component_count and ->component_list[]. It leaks stack information from the mwave_ioctl() function.

I've added a memset() to initialize the struct to zero.

Signed-off-by Dan Carpenter <[email protected]>

drivers/char/mwave/tp3780i.c +1 -0

index c689697..04e6d6a 100644
@@ -479,6 +479,7 @@ int tp3780I_QueryAbilities(THINKPAD_BD_DATA * pBDData, MW_ABILITIES * pAbilities
 	PRINTK_2(TRACE_TP3780I,
 		"tp3780i::tp3780I_QueryAbilities entry pBDData %p\n", pBDData);
 
+	memset(pAbilities, 0, sizeof(*pAbilities));
 	/* fill out standard constant fields */
 	pAbilities->instr_per_sec = pBDData->rDspSettings.uIps;
 	pAbilities->data_size = pBDData->rDspSettings.uDStoreSize;