Module: xenomai-forge
Branch: next
Commit: 5dd4e10155bdc0701ccdbf6fa44daf92924b7d28
URL:
http://git.xenomai.org/?p=xenomai-forge.git;a=commit;h=5dd4e10155bdc0701ccdbf6fa44daf92924b7d28
Author: Paul Janzen <p...@xenomai.sez.to>
Date: Sun Mar 17 11:56:46 2013 -0700
drivers/can: fix tx_timeout buffer size inconsistency
When formatting /proc/rtcan/sockets, tx_timeout is defined as
char[16], but a length of 20 is passed to rtcan_get_timeout_name. If
tx_timeout for any socket is infinite, this causes snprintf to zero
outside the buffer, leading to stack overflow and a kernel panic.
Make the tx_timeout buffer 20 bytes long instead.
Signed-off-by: Paul Janzen <p...@xenomai.sez.to>
Acked-by: Wolfgang Grandegger <w...@grandegger.com>
---
kernel/drivers/can/rtcan_module.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/kernel/drivers/can/rtcan_module.c
b/kernel/drivers/can/rtcan_module.c
index 3ebc333..f270f65 100644
--- a/kernel/drivers/can/rtcan_module.c
+++ b/kernel/drivers/can/rtcan_module.c
@@ -165,7 +165,7 @@ static int rtcan_read_proc_sockets(char *buf, char **start,
off_t offset,
struct rtdm_dev_context *context;
struct rtcan_device *dev;
char name[IFNAMSIZ] = "not-bound";
- char rx_timeout[20], tx_timeout[16];
+ char rx_timeout[20], tx_timeout[20];
rtdm_lockctx_t lock_ctx;
int ifindex;
RTCAN_PROC_PRINT_VARS(120);
_______________________________________________
Xenomai-git mailing list
Xenomai-git@xenomai.org
http://www.xenomai.org/mailman/listinfo/xenomai-git
