Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
authorColin Ian King <colin.king@canonical.com>
Wed, 4 Aug 2021 15:09:51 +0000 (16:09 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Sep 2021 09:45:20 +0000 (11:45 +0200)
commite4a0775a6a72e7ef13f61bbd1028d1ebe336cb1a
tree4b865e681b740316f0cac88cca0b67614916f04c
parentfad24def274d7ab991abe536510f2327f7ece248
Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow

[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ]

An earlier commit replaced using batostr to using %pMR sprintf for the
construction of session->name. Static analysis detected that this new
method can use a total of 21 characters (including the trailing '\0')
so we need to increase the BTNAMSIZ from 18 to 21 to fix potential
buffer overflows.

Addresses-Coverity: ("Out-of-bounds write")
Fixes: fcb73338ed53 ("Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/bluetooth/cmtp/cmtp.h