]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
staging: rtl8712: unterminated string leads to read overflow
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 24 Feb 2021 08:45:59 +0000 (11:45 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 17 Mar 2021 15:34:33 +0000 (16:34 +0100)
commitbf873575f32bbdcf5b07086f23fec12e7c7f55f5
treeadb33876cb2300d557b6df45c0bfed45da237ec3
parent33cdc63f0e07abf637ba326b6016731be958088d
staging: rtl8712: unterminated string leads to read overflow

commit d660f4f42ccea50262c6ee90c8e7ad19a69fb225 upstream.

The memdup_user() function does not necessarily return a NUL terminated
string so this can lead to a read overflow.  Switch from memdup_user()
to strndup_user() to fix this bug.

Fixes: c6dc001f2add ("staging: r8712u: Merging Realtek's latest (v2.6.6). Various fixes.")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YDYSR+1rj26NRhvb@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/rtl8712/rtl871x_ioctl_linux.c