linux/drivers/char/tpm
Eric Paris fbaa58696c TPM: get_event_name stack corruption
get_event_name uses sprintf to fill a buffer declared on the stack.  It fills
the buffer 2 bytes at a time.  What the code doesn't take into account is that
sprintf(buf, "%02x", data) actually writes 3 bytes.  2 bytes for the data and
then it nul terminates the string.  Since we declare buf to be 40 characters
long and then we write 40 bytes of data into buf sprintf is going to write 41
characters.  The fix is to leave room in buf for the nul terminator.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2009-05-20 08:30:05 +10:00
..
Kconfig securityfs: do not depend on CONFIG_SECURITY 2008-08-28 10:47:42 +10:00
Makefile
tpm.c TPM: integrity fix 2009-02-06 09:06:43 +11:00
tpm.h TPM: integrity interface 2009-02-03 11:23:12 +11:00
tpm_atmel.c platform driver: fix incorrect use of 'platform_bus_type' with 'struct device_driver' 2009-03-24 16:38:25 -07:00
tpm_atmel.h tpmdd maintainers 2007-08-22 19:52:44 -07:00
tpm_bios.c TPM: get_event_name stack corruption 2009-05-20 08:30:05 +10:00
tpm_infineon.c tpm: correct email address for tpm_infineon-driver 2009-02-11 14:25:35 -08:00
tpm_nsc.c tpm: clean up tpm_nsc driver for platform_device suspend/resume compliance 2009-01-08 08:31:12 -08:00
tpm_tis.c platform driver: fix incorrect use of 'platform_bus_type' with 'struct device_driver' 2009-03-24 16:38:25 -07:00