From patchwork Tue Jan 13 21:30:54 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 18299 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 6D457474C4 for ; Wed, 14 Jan 2009 08:31:50 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753884AbZAMVbq (ORCPT ); Tue, 13 Jan 2009 16:31:46 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753614AbZAMVbp (ORCPT ); Tue, 13 Jan 2009 16:31:45 -0500 Received: from smtp1.linux-foundation.org ([140.211.169.13]:35871 "EHLO smtp1.linux-foundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752780AbZAMVbo (ORCPT ); Tue, 13 Jan 2009 16:31:44 -0500 Received: from imap1.linux-foundation.org (imap1.linux-foundation.org [140.211.169.55]) by smtp1.linux-foundation.org (8.14.2/8.13.5/Debian-3ubuntu1.1) with ESMTP id n0DLUsPG028161 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 13 Jan 2009 13:30:55 -0800 Received: from localhost.localdomain (localhost [127.0.0.1]) by imap1.linux-foundation.org (8.13.5.20060308/8.13.5/Debian-3ubuntu1.1) with ESMTP id n0DLUsjq014237; Tue, 13 Jan 2009 13:30:54 -0800 Message-Id: <200901132130.n0DLUsjq014237@imap1.linux-foundation.org> Subject: [patch 1/1] drivers/net/irda/irda-usb.c: fix buffer overflow To: davem@davemloft.net Cc: netdev@vger.kernel.org, akpm@linux-foundation.org, josevteg@gmail.com, linville@tuxdriver.com, samuel@sortiz.org, stable@kernel.org From: akpm@linux-foundation.org Date: Tue, 13 Jan 2009 13:30:54 -0800 X-Spam-Status: No, hits=-3.415 required=5 tests=AWL, BAYES_00, OSDL_HEADER_SUBJECT_BRACKETED X-Spam-Checker-Version: SpamAssassin 3.2.4-osdl_revision__1.47__ X-MIMEDefang-Filter: lf$Revision: 1.188 $ X-Scanned-By: MIMEDefang 2.63 on 140.211.169.13 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Jos-Vicente Gilabert Taken from http://bugzilla.kernel.org/show_bug.cgi?id=12397 We're doing an sprintf of an 11-char string into an 11-char buffer. Whoops. It breaks firmware uploading. Reported-by: Jos-Vicente Gilabert Cc: David S. Miller Cc: Samuel Ortiz Cc: "John W. Linville" Cc: Signed-off-by: Andrew Morton --- drivers/net/irda/irda-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN drivers/net/irda/irda-usb.c~drivers-net-irda-irda-usbc-fix-buffer-overflow drivers/net/irda/irda-usb.c --- a/drivers/net/irda/irda-usb.c~drivers-net-irda-irda-usbc-fix-buffer-overflow +++ a/drivers/net/irda/irda-usb.c @@ -1073,7 +1073,7 @@ static int stir421x_patch_device(struct { unsigned int i; int ret; - char stir421x_fw_name[11]; + char stir421x_fw_name[12]; const struct firmware *fw; const unsigned char *fw_version_ptr; /* pointer to version string */ unsigned long fw_version = 0;