* [PATCH] Bluetooth: Fix out of scope variable access in hci_sock_cmsg()
@ 2010-02-15 21:23 Johann Felix Soden
2010-02-17 10:15 ` Marcel Holtmann
0 siblings, 1 reply; 2+ messages in thread
From: Johann Felix Soden @ 2010-02-15 21:23 UTC (permalink / raw)
To: Marcel Holtmann; +Cc: linux-bluetooth
From: Johann Felix Soden <johfel@users.sourceforge.net>
The pointer data can point to the variable ctv.
Access to data happens when ctv is already out of scope.
Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net>
---
net/bluetooth/hci_sock.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 688cfeb..b0e6108 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -338,8 +338,8 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
data = &tv;
len = sizeof(tv);
#ifdef CONFIG_COMPAT
+ struct compat_timeval ctv;
if (msg->msg_flags & MSG_CMSG_COMPAT) {
- struct compat_timeval ctv;
ctv.tv_sec = tv.tv_sec;
ctv.tv_usec = tv.tv_usec;
data = &ctv;
--
1.6.6.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Bluetooth: Fix out of scope variable access in hci_sock_cmsg()
2010-02-15 21:23 [PATCH] Bluetooth: Fix out of scope variable access in hci_sock_cmsg() Johann Felix Soden
@ 2010-02-17 10:15 ` Marcel Holtmann
0 siblings, 0 replies; 2+ messages in thread
From: Marcel Holtmann @ 2010-02-17 10:15 UTC (permalink / raw)
To: Johann Felix Soden; +Cc: linux-bluetooth
Hi Johann,
> The pointer data can point to the variable ctv.
> Access to data happens when ctv is already out of scope.
patch has been applied to my bluetooth-2.6 tree.
Regards
Marcel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-02-17 10:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-02-15 21:23 [PATCH] Bluetooth: Fix out of scope variable access in hci_sock_cmsg() Johann Felix Soden
2010-02-17 10:15 ` Marcel Holtmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).