netlink: pad nla_memcpy dest buffer with zeroes

This is especially important in cases where the kernel allocs a new structure and expects a field to be set from a netlink attribute. If such attribute is shorter than expected, the rest of the field is left containing previous data. When such field is read back by the user space, kernel memory content is leaked.

Jiri Benc committed 11 years ago

Commit 5899f041 parent f5e2dc51 file · +2 −0Browse files

Unified · Split

lib/nlattr.c+2−0

@@ -279,6 +279,8 @@ int nla_memcpy(void dest, const struct nlattr src, int count) · 278 unmodified lines
279	279	int minlen = min_t(int, count, nla_len(src));
280	280
281	281	memcpy(dest, nla_data(src), minlen);
	282	+ if (count > minlen)
	283	+ memset(dest + minlen, 0, count - minlen);
282	284
283	285	return minlen;
284	286	}