Module: xenomai-forge
Branch: next
Commit: f9e44bcb17d435c60a09ba690b99fb097fa6c6d2
URL:    
http://git.xenomai.org/?p=xenomai-forge.git;a=commit;h=f9e44bcb17d435c60a09ba690b99fb097fa6c6d2

Author: Paul Janzen <p...@xenomai.sez.to>
Date:   Sun Mar 17 11:56:46 2013 -0700

drivers/can: fix tx_timeout buffer size inconsistency

When formatting /proc/rtcan/sockets, tx_timeout is defined as
char[16], but a length of 20 is passed to rtcan_get_timeout_name. If
tx_timeout for any socket is infinite, this causes snprintf to zero
outside the buffer, leading to stack overflow and a kernel panic.
Make the tx_timeout buffer 20 bytes long instead.

Signed-off-by: Paul Janzen <p...@xenomai.sez.to>
Acked-by: Wolfgang Grandegger <w...@grandegger.com>

---

 kernel/drivers/can/rtcan_module.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/kernel/drivers/can/rtcan_module.c 
b/kernel/drivers/can/rtcan_module.c
index 3ebc333..f270f65 100644
--- a/kernel/drivers/can/rtcan_module.c
+++ b/kernel/drivers/can/rtcan_module.c
@@ -165,7 +165,7 @@ static int rtcan_read_proc_sockets(char *buf, char **start, 
off_t offset,
     struct rtdm_dev_context *context;
     struct rtcan_device *dev;
     char name[IFNAMSIZ] = "not-bound";
-    char rx_timeout[20], tx_timeout[16];
+    char rx_timeout[20], tx_timeout[20];
     rtdm_lockctx_t lock_ctx;
     int ifindex;
     RTCAN_PROC_PRINT_VARS(120);


_______________________________________________
Xenomai-git mailing list
Xenomai-git@xenomai.org
http://www.xenomai.org/mailman/listinfo/xenomai-git

Reply via email to