projects
/
platform
/
adaptation
/
renesas_rcar
/
renesas_kernel.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
746ae30
)
isdn: avoid copying too long drvid
author
Dan Carpenter
<dan.carpenter@oracle.com>
Thu, 24 Nov 2011 02:42:09 +0000
(
02:42
+0000)
committer
David S. Miller
<davem@davemloft.net>
Tue, 29 Nov 2011 23:39:37 +0000
(18:39 -0500)
"cfg->drvid" comes from the user so there is a possibility they
didn't NUL terminate it properly.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/isdn/i4l/isdn_net.c
patch
|
blob
|
history
diff --git
a/drivers/isdn/i4l/isdn_net.c
b/drivers/isdn/i4l/isdn_net.c
index
1f73d7f
..
2339d73
100644
(file)
--- a/
drivers/isdn/i4l/isdn_net.c
+++ b/
drivers/isdn/i4l/isdn_net.c
@@
-2756,6
+2756,9
@@
isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
char *c,
*e;
+ if (strnlen(cfg->drvid, sizeof(cfg->drvid)) ==
+ sizeof(cfg->drvid))
+ return -EINVAL;
drvidx = -1;
chidx = -1;
strcpy(drvid, cfg->drvid);