Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f9a23c84 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

isdnloop: use strlcpy() instead of strcpy() 



These strings come from a copy_from_user() and there is no way to be
sure they are NUL terminated.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9434266f

drivers/isdn/isdnloop/isdnloop.c

+5 −3
Original line number Diff line number Diff line
@@ -1083,8 +1083,10 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp) 
			spin_unlock_irqrestore(&card->isdnloop_lock, flags);

			return -ENOMEM;

		}

		for (i = 0; i < 3; i++)

			strcpy(card->s0num[i], sdef.num[i]);

		for (i = 0; i < 3; i++) {

			strlcpy(card->s0num[i], sdef.num[i],

				sizeof(card->s0num[0]));

		}

		break;

	case ISDN_PTYPE_1TR6:

		if (isdnloop_fake(card, "DRV1.04TC-1TR6-CAPI-CNS-BASIS-29.11.95",
@@ -1097,7 +1099,7 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp) 
			spin_unlock_irqrestore(&card->isdnloop_lock, flags);

			return -ENOMEM;

		}

		strcpy(card->s0num[0], sdef.num[0]);

		strlcpy(card->s0num[0], sdef.num[0], sizeof(card->s0num[0]));

		card->s0num[1][0] = '\0';

		card->s0num[2][0] = '\0';

		break;