Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-25 05:32:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

drivers/isdn: checkng length to be sure not memory overflow

Browse Source 
sizeof (cmd.parm.cmsg.para) is 50 (MAX_CAPI_PARA_LEN).
  sizeof (cmd.parm) is 80+, but less than 100.
  strlen(msg) may be more than 80+ (Modem-Commandbuffer, less than 255).
    isdn_tty_send_msg is called by isdn_tty_parse_at
    the relative parameter is m->mdmcmd (atemu *m)
    the relative command may be "+M..."

  so need check the length to be sure not memory overflow.
    cmd.parm is a union, and need keep original valid buffer length no touch

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Chen Gang 2013-03-07 18:25:41 +00:00 committed by David S. Miller
parent 2e85d67690
commit f39479363e
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/isdn/i4l/isdn_tty.c
View File

@ -902,7 +902,9 @@ isdn_tty_send_msg(modem_info *info, atemu *m, char *msg)
int j;
int l;
l = strlen(msg);
l = min(strlen(msg), sizeof(cmd.parm) - sizeof(cmd.parm.cmsg)
+ sizeof(cmd.parm.cmsg.para) - 2);
if (!l) {
isdn_tty_modem_result(RESULT_ERROR, info);
return;