| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 15 Sep 2006 17:19:31 +0200 From: Haavard Skinnemoen <hskinnemoen@...el.com> To: linux-mtd@...ts.infradead.org Cc: linux-kernel@...r.kernel.org, Josh Boyer <jwboyer@...il.com> Subject: [PATCH] MTD: Fix bug in fixup_convert_atmel_pri The memset() in fixup_convert_atmel_pri is supposed to zero out everything except the first 5 bytes in *extp, but it ends up zeroing out something way outside the struct instead. Fix this potentially dangerous code by casting the pointer to char * before doing arithmetic. Signed-off-by: Haavard Skinnemoen <hskinnemoen@...el.com> --- drivers/mtd/chips/cfi_cmdset_0002.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: linux-2.6.18-rc6-mm2/drivers/mtd/chips/cfi_cmdset_0002.c =================================================================== --- linux-2.6.18-rc6-mm2.orig/drivers/mtd/chips/cfi_cmdset_0002.c 2006-09-15 14:39:22.000000000 +0200 +++ linux-2.6.18-rc6-mm2/drivers/mtd/chips/cfi_cmdset_0002.c 2006-09-15 14:39:40.000000000 +0200 @@ -175,7 +175,7 @@ static void fixup_convert_atmel_pri(stru struct cfi_pri_atmel atmel_pri; memcpy(&atmel_pri, extp, sizeof(atmel_pri)); - memset(extp + 5, 0, sizeof(*extp) - 5); + memset((char *)extp + 5, 0, sizeof(*extp) - 5); if (atmel_pri.Features & 0x02) extp->EraseSuspend = 2; - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists