tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

I4L: fix isdn_ioctl memory overrun vulnerability

Fix possible memory overrun issue in the isdn ioctl code.

Found by ADLAB <adlab@venustech.com.cn>

Signed-off-by: Karsten Keil <kkeil@suse.de>
Cc: ADLAB <adlab@venustech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Karsten Keil and committed by
Linus Torvalds eafe1aa3 92d499d9

+4 -1
+4 -1
drivers/isdn/i4l/isdn_common.c
··· 1515 1515 if (copy_from_user(&iocts, argp, 1516 1516 sizeof(isdn_ioctl_struct))) 1517 1517 return -EFAULT; 1518 + iocts.drvid[sizeof(iocts.drvid)-1] = 0; 1518 1519 if (strlen(iocts.drvid)) { 1519 1520 if ((p = strchr(iocts.drvid, ','))) 1520 1521 *p = 0; ··· 1600 1599 if (copy_from_user(&iocts, argp, 1601 1600 sizeof(isdn_ioctl_struct))) 1602 1601 return -EFAULT; 1602 + iocts.drvid[sizeof(iocts.drvid)-1] = 0; 1603 1603 if (strlen(iocts.drvid)) { 1604 1604 drvidx = -1; 1605 1605 for (i = 0; i < ISDN_MAX_DRIVERS; i++) ··· 1645 1643 } else { 1646 1644 p = (char __user *) iocts.arg; 1647 1645 for (i = 0; i < 10; i++) { 1648 - sprintf(bname, "%s%s", 1646 + snprintf(bname, sizeof(bname), "%s%s", 1649 1647 strlen(dev->drv[drvidx]->msn2eaz[i]) ? 1650 1648 dev->drv[drvidx]->msn2eaz[i] : "_", 1651 1649 (i < 9) ? "," : "\0"); ··· 1675 1673 char *p; 1676 1674 if (copy_from_user(&iocts, argp, sizeof(isdn_ioctl_struct))) 1677 1675 return -EFAULT; 1676 + iocts.drvid[sizeof(iocts.drvid)-1] = 0; 1678 1677 if (strlen(iocts.drvid)) { 1679 1678 if ((p = strchr(iocts.drvid, ','))) 1680 1679 *p = 0;