Commit 77974fc2 authored by Arnaldo Carvalho de Melo's avatar Arnaldo Carvalho de Melo Committed by Greg Kroah-Hartman

[PATCH] leaking info on drivers/usb

I'm doing an audit wrt copy_to_user leaking info to userspace, started
with drivers/usb, please apply.
parent e18933e8
......@@ -2007,6 +2007,8 @@ static int usb_audio_ioctl_mixdev(struct inode *inode, struct file *file, unsign
if (cmd == SOUND_MIXER_INFO) {
mixer_info info;
memset(&info, 0, sizeof(info));
strncpy(info.id, "USB_AUDIO", sizeof(info.id));
strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
info.modify_counter = ms->modcnt;
......@@ -2016,6 +2018,8 @@ static int usb_audio_ioctl_mixdev(struct inode *inode, struct file *file, unsign
}
if (cmd == SOUND_OLD_MIXER_INFO) {
_old_mixer_info info;
memset(&info, 0, sizeof(info));
strncpy(info.id, "USB_AUDIO", sizeof(info.id));
strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
if (copy_to_user((void __user *)arg, &info, sizeof(info)))
......
......@@ -539,6 +539,7 @@ vicam_ioctl(struct inode *inode, struct file *file, unsigned int ioctlnr, unsign
struct video_capability b;
DBG("VIDIOCGCAP\n");
memset(&b, 0, sizeof(b));
strcpy(b.name, "ViCam-based Camera");
b.type = VID_TYPE_CAPTURE;
b.channels = 1;
......
......@@ -711,6 +711,7 @@ brlvger_ioctl(struct inode *inode, struct file *file,
case BRLVGER_GET_INFO: {
struct brlvger_info vi;
memset(&vi, 0, sizeof(vi));
strlcpy(vi.driver_version, DRIVER_VERSION,
sizeof(vi.driver_version));
strlcpy(vi.driver_banner, longbanner,
......
......@@ -1906,6 +1906,7 @@ static int edge_ioctl (struct usb_serial_port *port, struct file *file, unsigned
case TIOCGICOUNT:
cnow = edge_port->icount;
memset(&icount, 0, sizeof(icount));
icount.cts = cnow.cts;
icount.dsr = cnow.dsr;
icount.rng = cnow.rng;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment