From cab6ce9ebe89303bbf5eff442776188070a22771 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 3 Sep 2013 12:02:32 +0300 Subject: caif: add a sanity check to the tty name "tty->name" and "name" are a 64 character buffers. My static checker complains because we add the "cf" on the front so it look like we are copying a 66 character string into a 64 character buffer. Also if the name is larger than IFNAMSIZ (16) it triggers a BUG_ON() inside the call to alloc_netdev(). This is all under CAP_SYS_ADMIN so it's not a security fix, it just adds a little robustness. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller --- drivers/net/caif/caif_serial.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'drivers/net/caif') diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c index 34dea95d58db..88a6a5810ec6 100644 --- a/drivers/net/caif/caif_serial.c +++ b/drivers/net/caif/caif_serial.c @@ -347,7 +347,9 @@ static int ldisc_open(struct tty_struct *tty) /* release devices to avoid name collision */ ser_release(NULL); - sprintf(name, "cf%s", tty->name); + result = snprintf(name, sizeof(name), "cf%s", tty->name); + if (result >= IFNAMSIZ) + return -EINVAL; dev = alloc_netdev(sizeof(*ser), name, caifdev_setup); if (!dev) return -ENOMEM; -- cgit v1.2.3