[PATCH] Bluetooth: correct fix for CVE-2007-1353

Marcel Holtmann notified me that my previous fix for CVE-2007-1353
was wrong because of a stupid memcpy() with unchecked length, which
indeed made it worse than the original bug. Next time I'll be more
careful with copy-pasting !

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 8ececee..b66daa9 100644 (file)
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -469,7 +469,7 @@ int hci_sock_setsockopt(struct socket *sock, int level, int optname, char *optva
                break;
 
        case HCI_FILTER:
-               memcpy(&flt, &hci_pi(sk)->filter, len);
+               memcpy(&flt, &hci_pi(sk)->filter, sizeof(flt));
 
                len = MIN(len, sizeof(struct hci_filter));
                if (copy_from_user(&flt, optval, len)) {