Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d39d5ed9 authored by Karsten Keil's avatar Karsten Keil Committed by Linus Torvalds
Browse files

ISDN: Fix data access out of array bounds 



Fix against access random data bytes outside the dev->chanmap array.
Thanks to Oliver Neukum for pointing me to this issue.

Signed-off-by: default avatarKarsten Keil <kkeil@suse.de>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent e46dc1da

drivers/isdn/i4l/isdn_common.c

+3 −2
Original line number Diff line number Diff line
@@ -1135,7 +1135,7 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off) 
			if (count > dev->drv[drvidx]->stavail)

				count = dev->drv[drvidx]->stavail;

			len = dev->drv[drvidx]->interface->readstat(buf, count,

						drvidx, isdn_minor2chan(minor));

				drvidx, isdn_minor2chan(minor - ISDN_MINOR_CTRL));

			if (len < 0) {

				retval = len;

				goto out;
@@ -1207,7 +1207,8 @@ isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off 
		 */

		if (dev->drv[drvidx]->interface->writecmd)

			retval = dev->drv[drvidx]->interface->

				writecmd(buf, count, drvidx, isdn_minor2chan(minor));

				writecmd(buf, count, drvidx,

				isdn_minor2chan(minor - ISDN_MINOR_CTRL));

		else

			retval = count;

		goto out;