]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
authorColin Ian King <colin.king@canonical.com>
Wed, 4 Aug 2021 15:09:51 +0000 (16:09 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Sep 2021 07:50:37 +0000 (09:50 +0200)
commit5014a8453f0241cf4f8d35580a0129f76151907e
tree6ad66bb83e73dce6fbdd9577acfd2fdbfa0b7304
parentafffa7b4c6e47967cfac323dd7debd342abb15c7
Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow

[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ]

An earlier commit replaced using batostr to using %pMR sprintf for the
construction of session->name. Static analysis detected that this new
method can use a total of 21 characters (including the trailing '\0')
so we need to increase the BTNAMSIZ from 18 to 21 to fix potential
buffer overflows.

Addresses-Coverity: ("Out-of-bounds write")
Fixes: fcb73338ed53 ("Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/bluetooth/cmtp/cmtp.h