ieee802154: ca8210: fix uninitialised data read
In ca8210_test_int_user_write() a user can request the transfer of a
frame with a length field (command.length) that is longer than the
actual buffer provided (len). In this scenario the driver will copy
the buffer contents into the uninitialised command buffer, then
transfer <data.length> bytes over the SPI even though only <len> bytes
had been populated, potentially leaking sensitive kernel memory.
Also the first 6 bytes of the command buffer must be initialised in case
a malformed, short packet is written and the uninitialised bytes are
read in ca8210_test_check_upstream.
Reported-by: Domen Puncer Kugler <email@example.com>
Signed-off-by: Harry Morris <firstname.lastname@example.org>
Tested-by: Harry Morris <email@example.com>
Signed-off-by: Stefan Schmidt <firstname.lastname@example.org>
1 file changed