Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9f5af546 authored Jul 15, 2017 by Annie Cherkaev Committed by Linus Torvalds Aug 02, 2017

isdn/i4l: fix buffer overflow



This fixes a potential buffer overflow in isdn_net.c caused by an
unbounded strcpy.

[ ISDN seems to be effectively unmaintained, and the I4L driver in
  particular is long deprecated, but in case somebody uses this..
    - Linus ]

Signed-off-by: Jiten Thakkar <jitenmt@gmail.com>
Signed-off-by: Annie Cherkaev <annie.cherk@gmail.com>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 4d3f5d04

drivers/isdn/i4l/isdn_common.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -1376,6 +1376,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
		if (arg) {
		if (copy_from_user(bname, argp, sizeof(bname) - 1))
		return -EFAULT;
		bname[sizeof(bname)-1] = 0;
		} else
		return -EINVAL;
		ret = mutex_lock_interruptible(&dev->mtx);

drivers/isdn/i4l/isdn_net.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -2611,10 +2611,9 @@ isdn_net_newslave(char *parm)
		char newname[10];

		if (p) {
		/* Slave-Name MUST not be empty */
		if (!strlen(p + 1))
		/* Slave-Name MUST not be empty or overflow 'newname' */
		if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
		return NULL;
		strcpy(newname, p + 1);
		*p = 0;
		/* Master must already exist */
		if (!(n = isdn_net_findif(parm)))