isdn/i4l: fix buffer overflow
This fixes a potential buffer overflow in isdn_net.c caused by an unbounded strcpy. [ ISDN seems to be effectively unmaintained, and the I4L driver in particular is long deprecated, but in case somebody uses this.. - Linus ] Signed-off-by: Jiten Thakkar <jitenmt@gmail.com> Signed-off-by: Annie Cherkaev <annie.cherk@gmail.com> Cc: Karsten Keil <isdn@linux-pingi.de> Cc: Kees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
4d3f5d04d6
commit
9f5af546e6
|
@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
|
||||||
if (arg) {
|
if (arg) {
|
||||||
if (copy_from_user(bname, argp, sizeof(bname) - 1))
|
if (copy_from_user(bname, argp, sizeof(bname) - 1))
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
|
bname[sizeof(bname)-1] = 0;
|
||||||
} else
|
} else
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
ret = mutex_lock_interruptible(&dev->mtx);
|
ret = mutex_lock_interruptible(&dev->mtx);
|
||||||
|
|
|
@ -2611,10 +2611,9 @@ isdn_net_newslave(char *parm)
|
||||||
char newname[10];
|
char newname[10];
|
||||||
|
|
||||||
if (p) {
|
if (p) {
|
||||||
/* Slave-Name MUST not be empty */
|
/* Slave-Name MUST not be empty or overflow 'newname' */
|
||||||
if (!strlen(p + 1))
|
if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
|
||||||
return NULL;
|
return NULL;
|
||||||
strcpy(newname, p + 1);
|
|
||||||
*p = 0;
|
*p = 0;
|
||||||
/* Master must already exist */
|
/* Master must already exist */
|
||||||
if (!(n = isdn_net_findif(parm)))
|
if (!(n = isdn_net_findif(parm)))
|
||||||
|
|
Loading…
Reference in New Issue