[patch 15/46] drivers/net/irda/irda-usb.c: fix buffer overflow

From: Greg KH
Date: Thu Jan 22 2009 - 20:18:31 EST

2.6.28-stable review patch. If anyone has any objections, please let us know.


From: Jos-Vicente Gilabert <josevteg@xxxxxxxxx>

commit 2950e952920811be465ec95c6b56f03dc66a05c0 upstream.

Taken from http://bugzilla.kernel.org/show_bug.cgi?id=12397

We're doing an sprintf of an 11-char string into an 11-char buffer.
Whoops. It breaks firmware uploading.

Reported-by: Jos-Vicente Gilabert <josevteg@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxx>

drivers/net/irda/irda-usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1075,7 +1075,7 @@ static int stir421x_patch_device(struct
unsigned int i;
int ret;
- char stir421x_fw_name[11];
+ char stir421x_fw_name[12];
const struct firmware *fw;
const unsigned char *fw_version_ptr; /* pointer to version string */
unsigned long fw_version = 0;

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/