'discovery->data.info' length is 22, NICKNAME_MAX_LEN is 21, so the strncpy() will always left the last byte of 'discovery->data.info' uninitialized. When 'text' length is longer than 21 (NICKNAME_MAX_LEN), if still left the last byte of 'discovery->data.info' uninitialized, the next strlen() will cause issue. Also 'discovery->data' is 'struct irda_device_info' which defined in "include/uapi/...", it may copy to user mode, so need whole initialized. All together, need use kzalloc() instead of kmalloc() to initialize all members firstly. Signed-off-by: Chen Gang <gang.chen@asianux.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
---|---|---|
.. | ||
ircomm | ||
irlan | ||
irnet | ||
af_irda.c | ||
discovery.c | ||
irda_device.c | ||
iriap.c | ||
iriap_event.c | ||
irias_object.c | ||
irlap.c | ||
irlap_event.c | ||
irlap_frame.c | ||
irlmp.c | ||
irlmp_event.c | ||
irlmp_frame.c | ||
irmod.c | ||
irnetlink.c | ||
irproc.c | ||
irqueue.c | ||
irsysctl.c | ||
irttp.c | ||
Kconfig | ||
Makefile | ||
parameters.c | ||
qos.c | ||
timer.c | ||
wrapper.c |