diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-01-24 20:40:56 +0000 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2013-01-27 20:38:19 -0500 |
commit | 4bf613c6d87399e3c8a4d5e14281456b6959d8fd (patch) | |
tree | 6bdbb94f2d769c6c3b401a787d9f9f7f56ff3963 /include/net/gro_cells.h | |
parent | 6efecd8c51c0118038495a5e10a0d855938da9ad (diff) | |
download | linux-4bf613c6d87399e3c8a4d5e14281456b6959d8fd.tar.gz linux-4bf613c6d87399e3c8a4d5e14281456b6959d8fd.tar.bz2 linux-4bf613c6d87399e3c8a4d5e14281456b6959d8fd.zip |
irda: buffer overflow in irnet_ctrl_read()
The comments here say that the /* Max event is 61 char */ but in 2003 we
changed the event format and now the max event size is 75. The longest
event is:
"Discovered %08x (%s) behind %08x {hints %02X-%02X}\n",
12345678901 23 456789012 34567890 1 2 3
+8 +21 +8 +2 +2 +1
= 75 characters.
There was a check to return -EOVERFLOW if the user gave us a "count"
value that was less than 64. Raising it to 75 might break backwards
compatability. Instead I removed the check and now it returns a
truncated string if "count" is too low.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net/gro_cells.h')
0 files changed, 0 insertions, 0 deletions