Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a6a61c54 authored by Eric Sesterhenn's avatar Eric Sesterhenn Committed by Linus Torvalds
Browse files

[PATCH] Overrun in isdn_tty.c 



This fixes coverity bug id #1237.  After the while loop, it is possible for
i == ISDN_LMSNLEN.  If this happens the terminating '\0' is written after
the end of the array.

Signed-off-by: default avatarEric Sesterhenn <snakebyte@gmx.de>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 92d1dbd2

drivers/isdn/i4l/isdn_tty.c

+1 −1
Original line number Diff line number Diff line
@@ -2880,7 +2880,7 @@ isdn_tty_cmd_ATand(char **p, modem_info * info) 
			p[0]++;

			i = 0;

			while (*p[0] && (strchr("0123456789,-*[]?;", *p[0])) &&

			       (i < ISDN_LMSNLEN))

			       (i < ISDN_LMSNLEN - 1))

				m->lmsn[i++] = *p[0]++;

			m->lmsn[i] = '\0';

			break;