diff options
Diffstat (limited to 'tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch')
| -rw-r--r-- | tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch | 32 |
1 files changed, 0 insertions, 32 deletions
diff --git a/tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch b/tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch deleted file mode 100644 index 9cd7c09a3..000000000 --- a/tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 5d2be1422e02ccd697ccfcd45c85b4a26e6178e2 Mon Sep 17 00:00:00 2001 -From: Kangjie Lu <kangjielu@gmail.com> -Date: Thu, 2 Jun 2016 04:04:56 -0400 -Subject: tipc: fix an infoleak in tipc_nl_compat_link_dump - -link_info.str is a char array of size 60. Memory after the NULL -byte is not initialized. Sending the whole object out can cause -a leak. - -Signed-off-by: Kangjie Lu <kjlu@gatech.edu> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/tipc/netlink_compat.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c -index f795b1d..3ad9fab 100644 ---- a/net/tipc/netlink_compat.c -+++ b/net/tipc/netlink_compat.c -@@ -604,7 +604,8 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg, - - link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]); - link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP])); -- strcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME])); -+ nla_strlcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]), -+ TIPC_MAX_LINK_NAME); - - return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO, - &link_info, sizeof(link_info)); --- -cgit v0.12 - |