diff options
| author | Laxman Acharya Padhya <acharyalaxman8848@gmail.com> | 2026-08-31 15:44:22 +0545 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-08-31 13:39:11 -0400 |
| commit | ac8aa9e0ec93a12a60230066f199f49c3b9aac3d (patch) | |
| tree | 3595cad3fe572d6e2f7cfe5e995a4d58a8cc2cfd /tools/perf/scripts/python/bin/stackcollapse-record | |
| parent | a086c0892969bf8a0151b0f12bd14a68827c88b2 (diff) | |
Bluetooth: btintel: bound firmware ID by TLV length
The firmware ID is treated as a NUL-terminated string even though the
TLV length is its only boundary. If the value does not contain a NUL
terminator, snprintf() can read beyond the received response.
Limit the conversion to the advertised TLV value length.
Fixes: 164c62f958f8 ("Bluetooth: btintel: Add firmware ID to firmware name")
Reviewed-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Tested-by: Kiran K <kiran.k@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-record')
0 files changed, 0 insertions, 0 deletions