From 77974fc2429a04d9b522bcc2ecdc23b39f49419e Mon Sep 17 00:00:00 2001 From: Arnaldo Carvalho de Melo Date: Thu, 23 Oct 2003 02:58:45 -0700 Subject: [PATCH] [PATCH] leaking info on drivers/usb I'm doing an audit wrt copy_to_user leaking info to userspace, started with drivers/usb, please apply. --- drivers/usb/class/audio.c | 4 ++++ drivers/usb/media/vicam.c | 1 + drivers/usb/misc/brlvger.c | 1 + drivers/usb/serial/io_edgeport.c | 1 + 4 files changed, 7 insertions(+) diff --git a/drivers/usb/class/audio.c b/drivers/usb/class/audio.c index d87ddb18d9bd0..618c42d4cb287 100644 --- a/drivers/usb/class/audio.c +++ b/drivers/usb/class/audio.c @@ -2007,6 +2007,8 @@ static int usb_audio_ioctl_mixdev(struct inode *inode, struct file *file, unsign if (cmd == SOUND_MIXER_INFO) { mixer_info info; + + memset(&info, 0, sizeof(info)); strncpy(info.id, "USB_AUDIO", sizeof(info.id)); strncpy(info.name, "USB Audio Class Driver", sizeof(info.name)); info.modify_counter = ms->modcnt; @@ -2016,6 +2018,8 @@ static int usb_audio_ioctl_mixdev(struct inode *inode, struct file *file, unsign } if (cmd == SOUND_OLD_MIXER_INFO) { _old_mixer_info info; + + memset(&info, 0, sizeof(info)); strncpy(info.id, "USB_AUDIO", sizeof(info.id)); strncpy(info.name, "USB Audio Class Driver", sizeof(info.name)); if (copy_to_user((void __user *)arg, &info, sizeof(info))) diff --git a/drivers/usb/media/vicam.c b/drivers/usb/media/vicam.c index d67881bde5f89..be3ee0b3c8a9f 100644 --- a/drivers/usb/media/vicam.c +++ b/drivers/usb/media/vicam.c @@ -539,6 +539,7 @@ vicam_ioctl(struct inode *inode, struct file *file, unsigned int ioctlnr, unsign struct video_capability b; DBG("VIDIOCGCAP\n"); + memset(&b, 0, sizeof(b)); strcpy(b.name, "ViCam-based Camera"); b.type = VID_TYPE_CAPTURE; b.channels = 1; diff --git a/drivers/usb/misc/brlvger.c b/drivers/usb/misc/brlvger.c index 62a2903136cc5..067d81730b2e2 100644 --- a/drivers/usb/misc/brlvger.c +++ b/drivers/usb/misc/brlvger.c @@ -711,6 +711,7 @@ brlvger_ioctl(struct inode *inode, struct file *file, case BRLVGER_GET_INFO: { struct brlvger_info vi; + memset(&vi, 0, sizeof(vi)); strlcpy(vi.driver_version, DRIVER_VERSION, sizeof(vi.driver_version)); strlcpy(vi.driver_banner, longbanner, diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c index 628f4408c6b25..d73d1f07ab656 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -1906,6 +1906,7 @@ static int edge_ioctl (struct usb_serial_port *port, struct file *file, unsigned case TIOCGICOUNT: cnow = edge_port->icount; + memset(&icount, 0, sizeof(icount)); icount.cts = cnow.cts; icount.dsr = cnow.dsr; icount.rng = cnow.rng; -- 2.53.0