From patchwork Thu Aug 5 09:38:06 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 60945 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6F05DB6EF7 for ; Thu, 5 Aug 2010 19:38:40 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760023Ab0HEJif (ORCPT ); Thu, 5 Aug 2010 05:38:35 -0400 Received: from mail-ww0-f44.google.com ([74.125.82.44]:34762 "EHLO mail-ww0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759509Ab0HEJie (ORCPT ); Thu, 5 Aug 2010 05:38:34 -0400 Received: by wwj40 with SMTP id 40so7536186wwj.1 for ; Thu, 05 Aug 2010 02:38:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:mime-version:content-type:content-disposition:user-agent; bh=z6wlgr6uM6XoJpeCSPVHJeWORCDsUld+eqlnCu0iBig=; b=cgmta4w8Dyosub8PQ9Dc4B8poqt1SI8yYGHlDMAPRhc6dJFTRpMoZBgHwqjl4tNwj4 GdDX594PHZLWbPBJtu/OvKWGmbYpfL9cJUX5Nq8lDju2uiOa3uSxw9pbwsnWawKvj+W1 Ci9CehyIdBLRA3fIzXeQdTB6JPsAWHb4nD1Fo= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:user-agent; b=gYtIrjD3YOMj3d95y7lOSiq1jsOvwOL0dWrqKcyRj/rMNGig+7NS5RP6hO6ep0ys3d LtzKc+/OPVhegsYlWaax6tc3MJ9k3RgEql+5FDLesYa97vrcneNuPIKkaFJwxWiRlroV D+6RE80yxw2QFBbhn3XznX1dj1fv+xhpHOE7w= Received: by 10.227.155.203 with SMTP id t11mr8884615wbw.141.1281001112697; Thu, 05 Aug 2010 02:38:32 -0700 (PDT) Received: from bicker ([205.177.176.130]) by mx.google.com with ESMTPS id f30sm8146495wbe.18.2010.08.05.02.38.23 (version=TLSv1/SSLv3 cipher=RC4-MD5); Thu, 05 Aug 2010 02:38:31 -0700 (PDT) Date: Thu, 5 Aug 2010 11:38:06 +0200 From: Dan Carpenter To: Karsten Keil Cc: netdev@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] isdn: fix information leak Message-ID: <20100805093806.GF9031@bicker> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The main motivation of this patch changing strcpy() to strlcpy(). We strcpy() to copy a 48 byte buffers into a 49 byte buffers. So at best the last byte has leaked information, or maybe there is an overflow? Anyway, this patch closes the information leaks by zeroing the memory and the calls to strlcpy() prevent overflows. Signed-off-by: Dan Carpenter --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c index 1081091..2655e3a 100644 --- a/drivers/isdn/sc/ioctl.c +++ b/drivers/isdn/sc/ioctl.c @@ -174,7 +174,7 @@ int sc_ioctl(int card, scs_ioctl *data) pr_debug("%s: SCIOGETSPID: ioctl received\n", sc_adapter[card]->devicename); - spid = kmalloc(SCIOC_SPIDSIZE, GFP_KERNEL); + spid = kzalloc(SCIOC_SPIDSIZE, GFP_KERNEL); if (!spid) { kfree(rcvmsg); return -ENOMEM; @@ -194,7 +194,7 @@ int sc_ioctl(int card, scs_ioctl *data) kfree(rcvmsg); return status; } - strcpy(spid, rcvmsg->msg_data.byte_array); + strlcpy(spid, rcvmsg->msg_data.byte_array, SCIOC_SPIDSIZE); /* * Package the switch type and send to user space @@ -272,12 +272,12 @@ int sc_ioctl(int card, scs_ioctl *data) return status; } - dn = kmalloc(SCIOC_DNSIZE, GFP_KERNEL); + dn = kzalloc(SCIOC_DNSIZE, GFP_KERNEL); if (!dn) { kfree(rcvmsg); return -ENOMEM; } - strcpy(dn, rcvmsg->msg_data.byte_array); + strlcpy(dn, rcvmsg->msg_data.byte_array, SCIOC_DNSIZE); kfree(rcvmsg); /* @@ -348,7 +348,7 @@ int sc_ioctl(int card, scs_ioctl *data) pr_debug("%s: SCIOSTAT: ioctl received\n", sc_adapter[card]->devicename); - bi = kmalloc (sizeof(boardInfo), GFP_KERNEL); + bi = kzalloc(sizeof(boardInfo), GFP_KERNEL); if (!bi) { kfree(rcvmsg); return -ENOMEM;