diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-01-09 10:09:19 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-01-17 13:52:37 -0800 |
| commit | cb9cc9cae9ebde1148e48c9682205af8518ec0c9 (patch) | |
| tree | 2d273b84555f071223586dc7b55de3c428c15eb9 /drivers/staging/bcm | |
| parent | b3d07cf5a1045130057ebf39282092c31ceca185 (diff) | |
Staging: bcm: copying more data than intended
This was changed to bcm_flash2x_cs_info instead of bcm_flash_cs_info
when we got rid of the typedefs. bcm_flash2x_cs_info is quite a bit
larger than bcm_flash_cs_info (436 bytes instead of 96) so it would
corrupt user memory and it's an info leak.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/bcm')
| -rw-r--r-- | drivers/staging/bcm/Bcmchar.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c index 4ba1a5d1bf96..491e2bfbc464 100644 --- a/drivers/staging/bcm/Bcmchar.c +++ b/drivers/staging/bcm/Bcmchar.c @@ -1792,7 +1792,7 @@ cntrlEnd: if (IoBuffer.OutputLength < sizeof(struct bcm_flash_cs_info)) return -EINVAL; - if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash2x_cs_info))) + if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash_cs_info))) return -EFAULT; } } |