| Revision | f76d36ddb1a6da76d46185941f326739cbba5e41 (tree) |
|---|---|
| Zeit | 2007-12-10 15:18:34 |
| Autor | Willy Tarreau <w@1wt....> |
| Commiter | Willy Tarreau |
[PATCH] isdn: avoid copying overly-long strings
Backport of 2.6 commit 0f13864e5b24d9cbe18d125d41bfa4b726a82e40 by Karsten Keil
Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9416
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/isdn/isdn_net.c (diff)| @@ -2159,7 +2159,7 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup) | ||
| 2159 | 2159 | isdn_net_dev *p; |
| 2160 | 2160 | isdn_net_phone *n; |
| 2161 | 2161 | ulong flags; |
| 2162 | - char nr[32]; | |
| 2162 | + char nr[ISDN_MSNLEN]; | |
| 2163 | 2163 | char *my_eaz; |
| 2164 | 2164 | |
| 2165 | 2165 | /* Search name in netdev-chain */ |
| @@ -2169,8 +2169,10 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup) | ||
| 2169 | 2169 | nr[0] = '0'; |
| 2170 | 2170 | nr[1] = '\0'; |
| 2171 | 2171 | printk(KERN_INFO "isdn_net: Incoming call without OAD, assuming '0'\n"); |
| 2172 | - } else | |
| 2173 | - strcpy(nr, setup->phone); | |
| 2172 | + } else { | |
| 2173 | + strncpy(nr, setup->phone, ISDN_MSNLEN - 1); | |
| 2174 | + nr[ISDN_MSNLEN - 1] = 0; | |
| 2175 | + } | |
| 2174 | 2176 | si1 = (int) setup->si1; |
| 2175 | 2177 | si2 = (int) setup->si2; |
| 2176 | 2178 | if (!setup->eazmsn[0]) { |
| @@ -2855,7 +2857,8 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg) | ||
| 2855 | 2857 | chidx = -1; |
| 2856 | 2858 | } |
| 2857 | 2859 | } |
| 2858 | - strcpy(lp->msn, cfg->eaz); | |
| 2860 | + strncpy(lp->msn, cfg->eaz, sizeof(lp->msn) - 1); | |
| 2861 | + lp->msn[sizeof(lp->msn) - 1] = 0; | |
| 2859 | 2862 | lp->pre_device = drvidx; |
| 2860 | 2863 | lp->pre_channel = chidx; |
| 2861 | 2864 | lp->onhtime = cfg->onhtime; |
| @@ -3004,7 +3007,8 @@ isdn_net_addphone(isdn_net_ioctl_phone * phone) | ||
| 3004 | 3007 | if (p) { |
| 3005 | 3008 | if (!(n = (isdn_net_phone *) kmalloc(sizeof(isdn_net_phone), GFP_KERNEL))) |
| 3006 | 3009 | return -ENOMEM; |
| 3007 | - strcpy(n->num, phone->phone); | |
| 3010 | + strncpy(n->num, phone->phone, sizeof(n->num) - 1); | |
| 3011 | + n->num[sizeof(n->num) - 1] = 0; | |
| 3008 | 3012 | n->next = p->local->phone[phone->outgoing & 1]; |
| 3009 | 3013 | p->local->phone[phone->outgoing & 1] = n; |
| 3010 | 3014 | return 0; |
Linux Kernel Documents
Fork