tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ISDN: Fix data access out of array bounds

Fix against access random data bytes outside the dev->chanmap array.
Thanks to Oliver Neukum for pointing me to this issue.

Signed-off-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Karsten Keil and committed by
Linus Torvalds d39d5ed9 e46dc1da

+3 -2
+3 -2
drivers/isdn/i4l/isdn_common.c
··· 1135 1135 if (count > dev->drv[drvidx]->stavail) 1136 1136 count = dev->drv[drvidx]->stavail; 1137 1137 len = dev->drv[drvidx]->interface->readstat(buf, count, 1138 - drvidx, isdn_minor2chan(minor)); 1138 + drvidx, isdn_minor2chan(minor - ISDN_MINOR_CTRL)); 1139 1139 if (len < 0) { 1140 1140 retval = len; 1141 1141 goto out; ··· 1207 1207 */ 1208 1208 if (dev->drv[drvidx]->interface->writecmd) 1209 1209 retval = dev->drv[drvidx]->interface-> 1210 - writecmd(buf, count, drvidx, isdn_minor2chan(minor)); 1210 + writecmd(buf, count, drvidx, 1211 + isdn_minor2chan(minor - ISDN_MINOR_CTRL)); 1211 1212 else 1212 1213 retval = count; 1213 1214 goto out;