diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2022-05-24 22:02:45 +0200 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2022-07-22 02:07:16 +0200 |
| commit | dd7b8cdde098cf9f7c8de409b5b7bbb98f97be80 (patch) | |
| tree | 6a91198c1299aa40678c1220ed3b339bad7d0585 /net/bluetooth/mgmt.c | |
| parent | Bluetooth: use memset avoid memory leaks (diff) | |
| download | linux-dd7b8cdde098cf9f7c8de409b5b7bbb98f97be80.tar.xz linux-dd7b8cdde098cf9f7c8de409b5b7bbb98f97be80.zip | |
Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name}
Both dev_name and short_name are not guaranteed to be NULL terminated so
this instead use strnlen and then attempt to determine if the resulting
string needs to be truncated or not.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216018
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to '')
| -rw-r--r-- | net/bluetooth/mgmt.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index ae758ab1b558..ed8cd4a81ed3 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -1082,11 +1082,11 @@ static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, hdev->appearance); - name_len = strlen(hdev->dev_name); + name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, hdev->dev_name, name_len); - name_len = strlen(hdev->short_name); + name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, hdev->short_name, name_len); |