tree 1a59d9779903ad63dd8d037b702cbb3690d2d663
parent 07b7b1c823d602d0e5d3596387d7f0e67a7e9b5e
author Young Xiao <YangX92@hotmail.com> 1555053870 +0800
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1557503595 +0200

Bluetooth: hidp: fix buffer overflow

commit a1616a5ac99ede5d605047a9012481ce7ff18b16 upstream.

Struct ca is copied from userspace. It is not checked whether the "name"
field is NULL terminated, which allows local users to obtain potentially
sensitive information from kernel stack memory, via a HIDPCONNADD command.

This vulnerability is similar to CVE-2011-1079.

Signed-off-by: Young Xiao <YangX92@hotmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>