lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Bluetooth: Fix out of scope variable access in hci_sock_cmsg()

Browse Source 
The pointer data can point to the variable ctv.
Access to data happens when ctv is already out of scope.

Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
Johann Felix Soden
2010-02-15 22:23:48 +01:00
committed by Marcel Holtmann
parent 705e5711b6
commit f6e623a65c
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
net/bluetooth/hci_sock.c
View File

@@ -329,6 +329,9 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
} }
if (mask & HCI_CMSG_TSTAMP) { if (mask & HCI_CMSG_TSTAMP) {
#ifdef CONFIG_COMPAT
struct compat_timeval ctv;
#endif
struct timeval tv; struct timeval tv;
void *data; void *data;
int len; int len;
@@ -339,7 +342,6 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
len = sizeof(tv); len = sizeof(tv);
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
if (msg->msg_flags & MSG_CMSG_COMPAT) { if (msg->msg_flags & MSG_CMSG_COMPAT) {
struct compat_timeval ctv;
ctv.tv_sec = tv.tv_sec; ctv.tv_sec = tv.tv_sec;
ctv.tv_usec = tv.tv_usec; ctv.tv_usec = tv.tv_usec;
data = &ctv; data = &ctv;