Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4cb1585c authored by Annie Cherkaev's avatar Annie Cherkaev Committed by Greg Kroah-Hartman
Browse files

isdn/i4l: fix buffer overflow 



commit 9f5af546e6acc30f075828cb58c7f09665033967 upstream.

This fixes a potential buffer overflow in isdn_net.c caused by an
unbounded strcpy.

[ ISDN seems to be effectively unmaintained, and the I4L driver in
  particular is long deprecated, but in case somebody uses this..
    - Linus ]

Signed-off-by: default avatarJiten Thakkar <jitenmt@gmail.com>
Signed-off-by: default avatarAnnie Cherkaev <annie.cherk@gmail.com>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 588b2464

drivers/isdn/i4l/isdn_common.c

+1 −0
Original line number Diff line number Diff line
@@ -1379,6 +1379,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) 
			if (arg) {

				if (copy_from_user(bname, argp, sizeof(bname) - 1))

					return -EFAULT;

				bname[sizeof(bname)-1] = 0;

			} else

				return -EINVAL;

			ret = mutex_lock_interruptible(&dev->mtx);

drivers/isdn/i4l/isdn_net.c

+2 −3
Original line number Diff line number Diff line
@@ -2644,10 +2644,9 @@ isdn_net_newslave(char *parm) 
	char newname[10];



	if (p) {

		/* Slave-Name MUST not be empty */

		if (!strlen(p + 1))

		/* Slave-Name MUST not be empty or overflow 'newname' */

		if (strscpy(newname, p + 1, sizeof(newname)) <= 0)

			return NULL;

		strcpy(newname, p + 1);

		*p = 0;

		/* Master must already exist */

		if (!(n = isdn_net_findif(parm)))