Skip to content

Commit

Permalink
Staging: bcm: copying more data than intended
Browse files Browse the repository at this point in the history
This was changed to bcm_flash2x_cs_info instead of bcm_flash_cs_info
when we got rid of the typedefs.  bcm_flash2x_cs_info is quite a bit
larger than bcm_flash_cs_info (436 bytes instead of 96) so it would
corrupt user memory and it's an info leak.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Dan Carpenter authored and Greg Kroah-Hartman committed Jan 17, 2013
1 parent b3d07cf commit cb9cc9c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/staging/bcm/Bcmchar.c
Original file line number Diff line number Diff line change
Expand Up @@ -1792,7 +1792,7 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
if (IoBuffer.OutputLength < sizeof(struct bcm_flash_cs_info))
return -EINVAL;

if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash2x_cs_info)))
if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash_cs_info)))
return -EFAULT;
}
}
Expand Down

0 comments on commit cb9cc9c

Please sign in to comment.