• Itay Iellin's avatar
    Bluetooth: Fix the creation of hdev->name · 103a2f32
    Itay Iellin authored
    Set a size limit of 8 bytes of the written buffer to "hdev->name"
    including the terminating null byte, as the size of "hdev->name" is 8
    bytes. If an id value which is greater than 9999 is allocated,
    then the "snprintf(hdev->name, sizeof(hdev->name), "hci%d", id)"
    function call would lead to a truncation of the id value in decimal
    notation.
    
    Set an explicit maximum id parameter in the id allocation function call.
    The id allocation function defines the maximum allocated id value as the
    maximum id parameter value minus one. Therefore, HCI_MAX_ID is defined
    as 10000.
    Signed-off-by: default avatarItay Iellin <ieitayie@gmail.com>
    Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
    103a2f32
hci_core.c 88.2 KB