tree 396aec9ddc6cf739129872507891fc085056c525
parent a5df8e122f4f322d9d1d4e9c14bf998ff2e3406a
author Sharvil Nanavati <sharvil@google.com> 1392013308 -0800
committer Sharvil Nanavati <sharvil@google.com> 1392158861 -0800

Don't leak process-private data on Change Local Name command.

The Change Local Name command to the controller doesn't zero out
the contents of the command buffer before setting the contents. As
a result, the controller sees both the new device name and then
random data left over on the heap from previous operations. This
random data may contain sensitive information. Although the device
name is null-terminated, a controller may inadvertently leak the
additional information over the network.

This change fixes the behaviour by zeroing out the entire command
buffer before copying the device name into it. If the device name
doesn't occupy the entire buffer, the rest of it will be zero.

http://b/12949068

Change-Id: I4dd6ce6dd6709589fcd1e23f974db820820bc8e1