Bugzilla – Bug 2673
Missing memset lets setversion ioctl corrupt memory.
Last modified: 2005-05-27 20:41:03 UTC
drm_setversion() calls the driver specific version() function passing a pointer
to a local structure. The driver version function copies data to memory pointed
to by the name, date and desc structure elements if these are not NULL.
Since they are uninitialized and the structure lives on the stack these pointers
point to random addresses.
Bug found in 2.6.11 RC.
Created attachment 2049 [details] [review]
Committed on 2005/03/08 by airlied.