summaryrefslogtreecommitdiffstats
path: root/drivers/isdn
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2011-11-24 03:42:09 +0100
committerDavid S. Miller <davem@davemloft.net>2011-11-30 00:39:37 +0100
commit5dc5503f5a400be5a7dc611745a034f04b0679b8 (patch)
treeb717b567bd90f0f637d2d4ed48bea72567126a78 /drivers/isdn
parentisdn: make sure strings are null terminated (diff)
downloadlinux-5dc5503f5a400be5a7dc611745a034f04b0679b8.tar.xz
linux-5dc5503f5a400be5a7dc611745a034f04b0679b8.zip
isdn: avoid copying too long drvid
"cfg->drvid" comes from the user so there is a possibility they didn't NUL terminate it properly. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/isdn')
-rw-r--r--drivers/isdn/i4l/isdn_net.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index 1f73d7f7e024..2339d7396b9e 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -2756,6 +2756,9 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
char *c,
*e;
+ if (strnlen(cfg->drvid, sizeof(cfg->drvid)) ==
+ sizeof(cfg->drvid))
+ return -EINVAL;
drvidx = -1;
chidx = -1;
strcpy(drvid, cfg->drvid);