]> git.kernelconcepts.de Git - karo-tx-linux.git/commit
irda: prevent heap corruption on invalid nickname
authorDan Rosenberg <drosenberg@vsecurity.com>
Sat, 19 Mar 2011 20:14:30 +0000 (20:14 +0000)
committerGreg Kroah-Hartman <gregkh@suse.de>
Thu, 14 Apr 2011 23:53:25 +0000 (16:53 -0700)
commitd7a23a52a0b2bc246bda91ee7ef2660291ee1cf4
tree64ed8ad2aee340cebef9a03fbc1dc57d0c92df6e
parent396c7c0bf6a876915b4041cac703ce31b0bd6fb2
irda: prevent heap corruption on invalid nickname

commit d50e7e3604778bfc2dc40f440e0742dbae399d54 upstream.

Invalid nicknames containing only spaces will result in an underflow in
a memcpy size calculation, subsequently destroying the heap and
panicking.

v2 also catches the case where the provided nickname is longer than the
buffer size, which can result in controllable heap corruption.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
net/irda/irnet/irnet_ppp.c