Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:09:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

mfd: ipaq-micro: Fix out-of-bounds stack read in ipaq_micro_str

Browse Source 
ipaq_micro_str() decodes a UTF-16LE string into an ASCII string.
It copies characters to a stack buffer retstr, but fails to
null-terminate it. When kstrdup() is called on retstr, it can read past
the buffer into uninitialized stack memory, potentially leaking stack
contents.

Fix this by initializing retstr to zero.

Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://patch.msgid.link/aintJF4X5tWDW-Ej@google.com
Signed-off-by: Lee Jones <lee@kernel.org>
This commit is contained in:
Dmitry Torokhov
2026-07-30 14:32:36 +01:00
committed by Lee Jones
parent b87549a9bb
commit da3a98c941
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/mfd/ipaq-micro.c
+1 -1
View File
@@ -221,7 +221,7 @@ static void ipaq_micro_eeprom_read(struct ipaq_micro *micro,
static char *ipaq_micro_str(u8 *wchar, u8 len)
{
char retstr[256];
char retstr[256] = { 0 };
u8 i;
for (i = 0; i < len / 2; i++)