2011-09-19 18:41:09

by Anderson Briglia

Subject: [PATCH] Bluetooth: Fix wrong memcpy size on LE start encryption

From: Anderson Briglia <[email protected]>

This patch fixes wrong memcpy size when copying rand value to
HCI_OP_LE_START_ENC command.
The compiler pretends that the array parameter was declared as a pointer
and sizeof reports the size of the pointer. [1]

[1] http://www.c-faq.com/aryptr/aryparmsize.html

Signed-off-by: Anderson Briglia <[email protected]>
Signed-off-by: Anderson Lizardo <[email protected]>
---
net/bluetooth/hci_conn.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index ea7f031..c2df7bf 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -218,7 +218,7 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
cp.handle = cpu_to_le16(conn->handle);
memcpy(cp.ltk, ltk, sizeof(cp.ltk));
cp.ediv = ediv;
- memcpy(cp.rand, rand, sizeof(rand));
+ memcpy(cp.rand, rand, sizeof(cp.rand));

hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
}
--
1.7.4.1

2011-09-19 19:45:36

by Gustavo Padovan

Subject: Re: [PATCH] Bluetooth: Fix wrong memcpy size on LE start encryption

* [email protected] <[email protected]> [2011-09-19 14:41:09 -0400]:

> From: Anderson Briglia <[email protected]>
>
> This patch fixes wrong memcpy size when copying rand value to
> HCI_OP_LE_START_ENC command.
> The compiler pretends that the array parameter was declared as a pointer
> and sizeof reports the size of the pointer. [1]
>
> [1] http://www.c-faq.com/aryptr/aryparmsize.html
>
> Signed-off-by: Anderson Briglia <[email protected]>
> Signed-off-by: Anderson Lizardo <[email protected]>
> ---
> net/bluetooth/hci_conn.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)

Applied, thanks.

Gustavo