netrom: fix invalid use of sizeof in nr_recvmsg()

Wei Yongjun · davem330 · commit c802d759623a · 2013-04-08T22:49:23.000-04:00
sizeof() when applied to a pointer typed expression gives the size of the
pointer, not that of the pointed data.
Introduced by commit 3ce5ef(netrom: fix info leak via msg_name in nr_recvmsg)

Signed-off-by: Wei Yongjun &lt;yongjun_wei@trendmicro.com.cn&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
@@ -1173,7 +1173,7 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
 	}
 
 	if (sax != NULL) {
-		memset(sax, 0, sizeof(sax));
+		memset(sax, 0, sizeof(*sax));
 		sax->sax25_family = AF_NETROM;
 		skb_copy_from_linear_data_offset(skb, 7, sax->sax25_call.ax25_call,
 			      AX25_ADDR_LEN);

Original file line number	Diff line number	Diff line change
`@@ -1173,7 +1173,7 @@ static int nr_recvmsg(struct kiocb iocb, struct socket sock,`
`1173`	`1173`	`}`
`1174`	`1174`
`1175`	`1175`	`if (sax != NULL) {`
`1176`		`- memset(sax, 0, sizeof(sax));`
	`1176`	`+ memset(sax, 0, sizeof(*sax));`
`1177`	`1177`	`sax->sax25_family = AF_NETROM;`
`1178`	`1178`	`skb_copy_from_linear_data_offset(skb, 7, sax->sax25_call.ax25_call,`
`1179`	`1179`	`AX25_ADDR_LEN);`