diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-04-21 14:10:03 +0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2013-04-23 23:58:52 +0400 |
| commit | c06ca8f92b0b23dfd209fea27d71046c9c776910 (patch) | |
| tree | 4d6d1eacd65a01be17101f2f9564ba3bec38a32d /drivers/media | |
| parent | 59501bb792c66b85fb7fdbd740e788e3afc70bbd (diff) | |
| download | linux-c06ca8f92b0b23dfd209fea27d71046c9c776910.tar.xz | |
[media] media: info leak in media_device_enum_entities()
The last part of the "u_ent.name" buffer isn't cleared so it still has
uninitialized stack memory.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/media-device.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c index 99b80b6f7f67..1957c0df08fd 100644 --- a/drivers/media/media-device.c +++ b/drivers/media/media-device.c @@ -102,9 +102,12 @@ static long media_device_enum_entities(struct media_device *mdev, return -EINVAL; u_ent.id = ent->id; - u_ent.name[0] = '\0'; - if (ent->name) - strlcpy(u_ent.name, ent->name, sizeof(u_ent.name)); + if (ent->name) { + strncpy(u_ent.name, ent->name, sizeof(u_ent.name)); + u_ent.name[sizeof(u_ent.name) - 1] = '\0'; + } else { + memset(u_ent.name, 0, sizeof(u_ent.name)); + } u_ent.type = ent->type; u_ent.revision = ent->revision; u_ent.flags = ent->flags; |