Staging: bcm: copying more data than intended
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 9 Jan 2013 07:09:19 +0000 (10:09 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 17 Jan 2013 21:52:37 +0000 (13:52 -0800)
This was changed to bcm_flash2x_cs_info instead of bcm_flash_cs_info
when we got rid of the typedefs.  bcm_flash2x_cs_info is quite a bit
larger than bcm_flash_cs_info (436 bytes instead of 96) so it would
corrupt user memory and it's an info leak.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/bcm/Bcmchar.c

index 4ba1a5d1bf96dc853d7cb26d5ef665893e75fc03..491e2bfbc46487a51cbb4e62ef71613876b0cddb 100644 (file)
@@ -1792,7 +1792,7 @@ cntrlEnd:
                        if (IoBuffer.OutputLength < sizeof(struct bcm_flash_cs_info))
                                return -EINVAL;
 
-                       if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash2x_cs_info)))
+                       if (copy_to_user(IoBuffer.OutputBuffer, Adapter->psFlashCSInfo, sizeof(struct bcm_flash_cs_info)))
                                return -EFAULT;
                }
        }