staging: dgrp: info leak in dgrp_dpa_ioctl()

PATCH New Dan Carpenter 1 participant 1 message Apr 21, 2013

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2013-04-21 11:08 UTC #0 lore raw

PATCH 1/1 staging: dgrp: info leak in dgrp_dpa_ioctl()

If "nd->nd_vpd_len" is less than 512 then the last part of the "vpd.vpd_data" has uninitialized stack information. We need to clear it before copying the buffer to user space.

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/dgrp/dgrp_dpa_ops.c +1 -0

index 43209c1..d99c227 100644
@@ -408,6 +408,7 @@ static long dgrp_dpa_ioctl(struct file *file, unsigned int cmd,
 
 
 	case DIGI_GETVPD:
+		memset(&vpd, 0, sizeof(vpd));
 		if (nd->nd_vpd_len > 0) {
 			vpd.vpd_len = nd->nd_vpd_len;
 			memcpy(&vpd.vpd_data, &nd->nd_vpd, nd->nd_vpd_len);