rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The ima_lsm_rule_init function in security/integrity/ima/ima_policy.c in the Linux kernel before 2.6.37, when the Linux Security Modules (LSM) framework is disabled, allows local users to bypass Integrity Measurement Architecture (IMA) rules in opportunistic circumstances by leveraging an administrator's addition of an IMA rule for LSM.
Vulnerability ID: CVE-2011-0006
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2012-06-21
File: security/integrity/ima/ima_policy.c
Commit message: ima: fix add LSM rule bug

If security_filter_rule_init() doesn't return a rule, then not everything
is as fine as the return code implies.

This bug only occurs when the LSM (eg. SELinux) is disabled at runtime.

Adding an empty LSM rule causes ima_match_rules() to always succeed,
ignoring any remaining rules.

 default IMA TCB policy:
  # PROC_SUPER_MAGIC
  dont_measure fsmagic=0x9fa0
  # SYSFS_MAGIC
  dont_measure fsmagic=0x62656572
  # DEBUGFS_MAGIC
  dont_measure fsmagic=0x64626720
  # TMPFS_MAGIC
  dont_measure fsmagic=0x01021994
  # SECURITYFS_MAGIC
  dont_measure fsmagic=0x73636673

  < LSM specific rule >
  dont_measure obj_type=var_log_t

  measure func=BPRM_CHECK
  measure func=FILE_MMAP mask=MAY_EXEC
  measure func=FILE_CHECK mask=MAY_READ uid=0

Thus without the patch, with the boot parameters 'tcb selinux=0', adding
the above 'dont_measure obj_type=var_log_t' rule to the default IMA TCB
measurement policy, would result in nothing being measured.  The patch
prevents the default TCB policy from being replaced.

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Cc: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Cc: David Safford <safford@watson.ibm.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Mimi Zohar

Vulnerable version (before fix):
 static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry, 	result = security_filter_rule_init(entry->lsm[lsm_rule].type, 					   Audit_equal, args, 					   &entry->lsm[lsm_rule].rule); 	return result; } 

Fixed version (after fix):
 static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry, 	result = security_filter_rule_init(entry->lsm[lsm_rule].type, 					   Audit_equal, args, 					   &entry->lsm[lsm_rule].rule); 	if (!entry->lsm[lsm_rule].rule) 		return -EINVAL; 	return result; } 

Patch:
patch: @@ -253,6 +253,8 @@ static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry,
 	result = security_filter_rule_init(entry->lsm[lsm_rule].type,
 					   Audit_equal, args,
 					   &entry->lsm[lsm_rule].rule);
+	if (!entry->lsm[lsm_rule].rule)
+		return -EINVAL;
 	return result;
 }
path: security/integrity/ima/ima_policy.c
Vulnerability: Buffer overflow in the mainloop function in nbd-server.c in the server in Network Block Device (nbd) before 2.9.20 might allow remote attackers to execute arbitrary code via a long request.  NOTE: this issue exists because of a CVE-2005-3534 regression.
Vulnerability ID: CVE-2011-0530
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/yoe/nbd
Published: 2011-02-22
File: nbd-server.c
Commit message: Fix buffer size checking

Yes, this means we've re-introduced CVE-2005-3534. Sigh.
Commit author: Wouter Verhelst

Vulnerable version (before fix):
 gboolean do_oldstyle=FALSE; #define OFFT_MAX ~((off_t)1<<(sizeof(off_t)*8-1)) #define LINELEN 256	  /**< Size of static buffer used to read the 			       authorization file (yuck) */ #define BUFSIZE (1024*1024) /**< Size of buffer that can hold requests */ #define DIFFPAGESIZE 4096 /**< diff file uses those chunks */ #define F_READONLY 1      /**< flag to tell us a file is readonly */ #define F_MULTIFILE 2	  /**< flag to tell us a file is exported using -m */ int mainloop(CLIENT *client) {  		if (request.magic != htonl(NBD_REQUEST_MAGIC)) 			err("Not enough magic."); 		if (len > BUFSIZE + sizeof(struct nbd_reply)) 			err("Request too big!"); #ifdef DODBG 		printf("%s from %llu (%llu) len %d, ", request.type ? "WRITE" :

Fixed version (after fix):
 gboolean do_oldstyle=FALSE; #define OFFT_MAX ~((off_t)1<<(sizeof(off_t)*8-1)) #define LINELEN 256	  /**< Size of static buffer used to read the 			       authorization file (yuck) */ #define BUFSIZE ((1024*1024)+sizeof(struct nbd_reply)) /**< Size of buffer that can hold requests */ #define DIFFPAGESIZE 4096 /**< diff file uses those chunks */ #define F_READONLY 1      /**< flag to tell us a file is readonly */ #define F_MULTIFILE 2	  /**< flag to tell us a file is exported using -m */ int mainloop(CLIENT *client) {  		if (request.magic != htonl(NBD_REQUEST_MAGIC)) 			err("Not enough magic."); 		if (len > BUFSIZE - sizeof(struct nbd_reply)) 			err("Request too big!"); #ifdef DODBG 		printf("%s from %llu (%llu) len %d, ", request.type ? "WRITE" :

Patch:
patch: @@ -150,7 +150,7 @@ gboolean do_oldstyle=FALSE;
 #define OFFT_MAX ~((off_t)1<<(sizeof(off_t)*8-1))
 #define LINELEN 256	  /**< Size of static buffer used to read the
 			       authorization file (yuck) */
-#define BUFSIZE (1024*1024) /**< Size of buffer that can hold requests */
+#define BUFSIZE ((1024*1024)+sizeof(struct nbd_reply)) /**< Size of buffer that can hold requests */
 #define DIFFPAGESIZE 4096 /**< diff file uses those chunks */
 #define F_READONLY 1      /**< flag to tell us a file is readonly */
 #define F_MULTIFILE 2	  /**< flag to tell us a file is exported using -m */
@@ -1389,7 +1389,7 @@ int mainloop(CLIENT *client) {
 
 		if (request.magic != htonl(NBD_REQUEST_MAGIC))
 			err("Not enough magic.");
-		if (len > BUFSIZE + sizeof(struct nbd_reply))
+		if (len > BUFSIZE - sizeof(struct nbd_reply))
 			err("Request too big!");
 #ifdef DODBG
 		printf("%s from %llu (%llu) len %d, ", request.type ? "WRITE" :
path: nbd-server.c
Vulnerability: The br_multicast_add_group function in net/bridge/br_multicast.c in the Linux kernel before 2.6.38, when a certain Ethernet bridge configuration is used, allows local users to cause a denial of service (memory corruption and system crash) by sending IGMP packets to a local interface.
Vulnerability ID: CVE-2011-0716
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-06-21
File: net/bridge/br_multicast.c
Commit message: bridge: Fix mglist corruption that leads to memory corruption

The list mp->mglist is used to indicate whether a multicast group
is active on the bridge interface itself as opposed to one of the
constituent interfaces in the bridge.

Unfortunately the operation that adds the mp->mglist node to the
list neglected to check whether it has already been added.  This
leads to list corruption in the form of nodes pointing to itself.

Normally this would be quite obvious as it would cause an infinite
loop when walking the list.  However, as this list is never actually
walked (which means that we don't really need it, I'll get rid of
it in a subsequent patch), this instead is hidden until we perform
a delete operation on the affected nodes.

As the same node may now be pointed to by more than one node, the
delete operations can then cause modification of freed memory.

This was observed in practice to cause corruption in 512-byte slabs,
most commonly leading to crashes in jbd2.

Thanks to Josef Bacik for pointing me in the right direction.

Reported-by: Ian Page Hands <ihands@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Herbert Xu

Vulnerable version (before fix):
 static int br_multicast_add_group(struct net_bridge *br, 		goto err;  	if (!port) { 		hlist_add_head(&mp->mglist, &br->mglist); 		mod_timer(&mp->timer, now + br->multicast_membership_interval); 		goto out; 	}

Fixed version (after fix):
 static int br_multicast_add_group(struct net_bridge *br, 		goto err;  	if (!port) { 		if (hlist_unhashed(&mp->mglist)) 			hlist_add_head(&mp->mglist, &br->mglist); 		mod_timer(&mp->timer, now + br->multicast_membership_interval); 		goto out; 	}

Patch:
patch: @@ -719,7 +719,8 @@ static int br_multicast_add_group(struct net_bridge *br,
 		goto err;
 
 	if (!port) {
-		hlist_add_head(&mp->mglist, &br->mglist);
+		if (hlist_unhashed(&mp->mglist))
+			hlist_add_head(&mp->mglist, &br->mglist);
 		mod_timer(&mp->timer, now + br->multicast_membership_interval);
 		goto out;
 	}
path: net/bridge/br_multicast.c
Vulnerability: The RuntimeHelpers.InitializeArray method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, does not properly restrict data types, which allows remote attackers to modify internal read-only data structures, and cause a denial of service (plugin crash) or corrupt the internal state of the security manager, via a crafted media file, as demonstrated by modifying a C# struct.
Vulnerability ID: CVE-2011-0989
CWE: CWE-264
Severity score: 4.9
Project: https://github.com/mono/mono
Published: 2011-04-13
File: mono/metadata/icall.c
Commit message: Allow only primitive types/enums in RuntimeHelpers.InitializeArray ().
Commit author: Zoltan Varga

Vulnerable version (before fix):
 ves_icall_System_Runtime_CompilerServices_RuntimeHelpers_InitializeArray (MonoAr 	int align; 	const char *field_data;  	if (MONO_TYPE_IS_REFERENCE (type) || 			(type->type == MONO_TYPE_VALUETYPE && 				(!mono_type_get_class (type) || 				mono_type_get_class (type)->has_references))) { 		MonoException *exc = mono_get_exception_argument("array", 			"Cannot initialize array containing references"); 		mono_raise_exception (exc); 	} 

Fixed version (after fix):
 ves_icall_System_Runtime_CompilerServices_RuntimeHelpers_InitializeArray (MonoAr 	int align; 	const char *field_data;  	if (MONO_TYPE_IS_REFERENCE (type) || type->type == MONO_TYPE_VALUETYPE) { 		MonoException *exc = mono_get_exception_argument("array", 			"Cannot initialize array of non-primitive type."); 		mono_raise_exception (exc); 	} 

Patch:
patch: @@ -854,12 +854,9 @@ ves_icall_System_Runtime_CompilerServices_RuntimeHelpers_InitializeArray (MonoAr
 	int align;
 	const char *field_data;
 
-	if (MONO_TYPE_IS_REFERENCE (type) ||
-			(type->type == MONO_TYPE_VALUETYPE &&
-				(!mono_type_get_class (type) ||
-				mono_type_get_class (type)->has_references))) {
+	if (MONO_TYPE_IS_REFERENCE (type) || type->type == MONO_TYPE_VALUETYPE) {
 		MonoException *exc = mono_get_exception_argument("array",
-			"Cannot initialize array containing references");
+			"Cannot initialize array of non-primitive type.");
 		mono_raise_exception (exc);
 	}
path: mono/metadata/icall.c
Vulnerability: Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service (plugin crash) or obtain sensitive information via vectors related to member data in a resurrected MonoThread instance.
Vulnerability ID: CVE-2011-0992
CWE: CWE-399
Severity score: 4.9
Project: https://github.com/mono/mono
Published: 2011-04-13
File: mono/metadata/threads.c
Commit message: Fix access to freed members of a dead thread

* threads.c: Fix access to freed members of a dead thread. Found
and fixed by Rodrigo Kumpera <rkumpera@novell.com>
Ref: CVE-2011-0992
Commit author: Sebastien Pouliot

Vulnerable version (before fix):
 void ves_icall_System_Threading_InternalThread_Thread_free_internal (MonoInterna 		CloseHandle (thread);  	if (this->synch_cs) { 		DeleteCriticalSection (this->synch_cs); 		g_free (this->synch_cs); 		this->synch_cs = NULL; 	}  	g_free (this->name); }  static void mono_thread_start (MonoThread *thread)

Fixed version (after fix):
 void ves_icall_System_Threading_InternalThread_Thread_free_internal (MonoInterna 		CloseHandle (thread);  	if (this->synch_cs) { 		CRITICAL_SECTION *synch_cs = this->synch_cs; 		this->synch_cs = NULL; 		DeleteCriticalSection (synch_cs); 		g_free (synch_cs); 	}  	if (this->name) { 		void *name = this->name; 		this->name = NULL; 		g_free (name); 	} }  static void mono_thread_start (MonoThread *thread)

Patch:
patch: @@ -1036,12 +1036,17 @@ void ves_icall_System_Threading_InternalThread_Thread_free_internal (MonoInterna
 		CloseHandle (thread);
 
 	if (this->synch_cs) {
-		DeleteCriticalSection (this->synch_cs);
-		g_free (this->synch_cs);
+		CRITICAL_SECTION *synch_cs = this->synch_cs;
 		this->synch_cs = NULL;
+		DeleteCriticalSection (synch_cs);
+		g_free (synch_cs);
 	}
 
-	g_free (this->name);
+	if (this->name) {
+		void *name = this->name;
+		this->name = NULL;
+		g_free (name);
+	}
 }
 
 static void mono_thread_start (MonoThread *thread)
path: mono/metadata/threads.c
Vulnerability: The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option.
Vulnerability ID: CVE-2011-1078
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2012-06-21
File: net/bluetooth/sco.c
Commit message: Bluetooth: sco: fix information leak to userspace

struct sco_conninfo has one padding byte in the end.  Local variable
cinfo of type sco_conninfo is copied to userspace with this uninizialized
one byte, leading to old stack contents leak.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Commit author: Vasiliy Kulikov

Vulnerable version (before fix):
 static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user 			break; 		}  		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle; 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3); 

Fixed version (after fix):
 static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user 			break; 		}  		memset(&cinfo, 0, sizeof(cinfo)); 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle; 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3); 

Patch:
patch: @@ -703,6 +703,7 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
 			break;
 		}
 
+		memset(&cinfo, 0, sizeof(cinfo));
 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
path: net/bluetooth/sco.c
Vulnerability: The bnep_sock_ioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory, or cause a denial of service (BUG and system crash), via a BNEPCONNADD command.
Vulnerability ID: CVE-2011-1079
CWE: CWE-20
Severity score: 7.8
Project: https://github.com/torvalds/linux
Published: 2012-06-21
File: net/bluetooth/bnep/sock.c
Commit message: Bluetooth: bnep: fix buffer overflow

Struct ca is copied from userspace.  It is not checked whether the "device"
field is NULL terminated.  This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Commit author: Vasiliy Kulikov

Vulnerable version (before fix):
 static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long 			sockfd_put(nsock); 			return -EBADFD; 		}  		err = bnep_add_connection(&ca, nsock); 		if (!err) {

Fixed version (after fix):
 static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long 			sockfd_put(nsock); 			return -EBADFD; 		} 		ca.device[sizeof(ca.device)-1] = 0;  		err = bnep_add_connection(&ca, nsock); 		if (!err) {

Patch:
patch: @@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
 			sockfd_put(nsock);
 			return -EBADFD;
 		}
+		ca.device[sizeof(ca.device)-1] = 0;
 
 		err = bnep_add_connection(&ca, nsock);
 		if (!err) {
path: net/bluetooth/bnep/sock.c
Vulnerability: The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table, and then reading a modprobe command line.
Vulnerability ID: CVE-2011-1080
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2012-06-21
File: net/bridge/netfilter/ebtables.c
Commit message: bridge: netfilter: fix information leak

Struct tmp is copied from userspace.  It is not checked whether the "name"
field is NULL terminated.  This may lead to buffer overflow and passing
contents of kernel stack as a module name to try_then_request_module() and,
consequently, to modprobe commandline.  It would be seen by all userspace
processes.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Commit author: Vasiliy Kulikov

Vulnerable version (before fix):
 static int do_replace(struct net *net, const void __user *user, 	if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) 		return -ENOMEM;  	countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; 	newinfo = vmalloc(sizeof(*newinfo) + countersize); 	if (!newinfo)

Fixed version (after fix):
 static int do_replace(struct net *net, const void __user *user, 	if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) 		return -ENOMEM;  	tmp.name[sizeof(tmp.name) - 1] = 0;  	countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; 	newinfo = vmalloc(sizeof(*newinfo) + countersize); 	if (!newinfo)

Patch:
patch: @@ -1107,6 +1107,8 @@ static int do_replace(struct net *net, const void __user *user,
 	if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
 		return -ENOMEM;
 
+	tmp.name[sizeof(tmp.name) - 1] = 0;
+
 	countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
 	newinfo = vmalloc(sizeof(*newinfo) + countersize);
 	if (!newinfo)
path: net/bridge/netfilter/ebtables.c
Vulnerability: The tpm_open function in drivers/char/tpm/tpm.c in the Linux kernel before 2.6.39 does not initialize a certain buffer, which allows local users to obtain potentially sensitive information from kernel memory via unspecified vectors.
Vulnerability ID: CVE-2011-1160
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2012-06-21
File: drivers/char/tpm/tpm.c
Commit message: char/tpm: Fix unitialized usage of data buffer

This patch fixes information leakage to the userspace by initializing
the data buffer to zero.

Reported-by: Peter Huewe <huewe.external@infineon.com>
Signed-off-by: Peter Huewe <huewe.external@infineon.com>
Signed-off-by: Marcel Selhorst <m.selhorst@sirrix.com>
[ Also removed the silly "* sizeof(u8)".  If that isn't 1, we have way
  deeper problems than a simple multiplication can fix.   - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Peter Huewe

Vulnerable version (before fix):
 int tpm_open(struct inode *inode, struct file *file) 		return -EBUSY; 	}  	chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL); 	if (chip->data_buffer == NULL) { 		clear_bit(0, &chip->is_open); 		put_device(chip->dev);

Fixed version (after fix):
 int tpm_open(struct inode *inode, struct file *file) 		return -EBUSY; 	}  	chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL); 	if (chip->data_buffer == NULL) { 		clear_bit(0, &chip->is_open); 		put_device(chip->dev);

Patch:
patch: @@ -980,7 +980,7 @@ int tpm_open(struct inode *inode, struct file *file)
 		return -EBUSY;
 	}
 
-	chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
+	chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
 	if (chip->data_buffer == NULL) {
 		clear_bit(0, &chip->is_open);
 		put_device(chip->dev);
path: drivers/char/tpm/tpm.c
Vulnerability: Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/iriap.c in the Linux kernel before 2.6.39 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging connectivity to an IrDA infrared network and sending a large integer value for a (1) name length or (2) attribute length.
Vulnerability ID: CVE-2011-1180
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2013-06-08
File: net/irda/iriap.c
Commit message: irda: validate peer name and attribute lengths

Length fields provided by a peer for names and attributes may be longer
than the destination array sizes.  Validate lengths to prevent stack
buffer overflows.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Dan Rosenberg

Vulnerable version (before fix):
 static void iriap_getvaluebyclass_indication(struct iriap_cb *self, 	n = 1;  	name_len = fp[n++]; 	memcpy(name, fp+n, name_len); n+=name_len; 	name[name_len] = '\0';  	attr_len = fp[n++]; 	memcpy(attr, fp+n, attr_len); n+=attr_len; 	attr[attr_len] = '\0'; 

Fixed version (after fix):
 static void iriap_getvaluebyclass_indication(struct iriap_cb *self, 	n = 1;  	name_len = fp[n++];  	IRDA_ASSERT(name_len < IAS_MAX_CLASSNAME + 1, return;);  	memcpy(name, fp+n, name_len); n+=name_len; 	name[name_len] = '\0';  	attr_len = fp[n++];  	IRDA_ASSERT(attr_len < IAS_MAX_ATTRIBNAME + 1, return;);  	memcpy(attr, fp+n, attr_len); n+=attr_len; 	attr[attr_len] = '\0'; 

Patch:
patch: @@ -656,10 +656,16 @@ static void iriap_getvaluebyclass_indication(struct iriap_cb *self,
 	n = 1;
 
 	name_len = fp[n++];
+
+	IRDA_ASSERT(name_len < IAS_MAX_CLASSNAME + 1, return;);
+
 	memcpy(name, fp+n, name_len); n+=name_len;
 	name[name_len] = '\0';
 
 	attr_len = fp[n++];
+
+	IRDA_ASSERT(attr_len < IAS_MAX_ATTRIBNAME + 1, return;);
+
 	memcpy(attr, fp+n, attr_len); n+=attr_len;
 	attr[attr_len] = '\0';
path: net/irda/iriap.c