diff options
| author | Dan Carpenter | 2013-01-24 07:41:43 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2013-01-25 20:21:26 +0100 |
| commit | 96a8d14e875a017f9e9e71d93433414e9fb8863f (patch) | |
| tree | 80e1968fc8318243921c35be0cf6324f4fa01e9f /drivers/staging/cxt1e1 | |
| parent | staging: vt6656: Revert: 64bit fixes: dpc.c incorrect addressing of void stru... (diff) | |
| download | kernel-qcow2-linux-96a8d14e875a017f9e9e71d93433414e9fb8863f.tar.gz kernel-qcow2-linux-96a8d14e875a017f9e9e71d93433414e9fb8863f.tar.xz kernel-qcow2-linux-96a8d14e875a017f9e9e71d93433414e9fb8863f.zip | |
staging: cxt1e1: buffer overflow in do_del_chan()
If we don't restrict "cp.channum" to 3 digits then the sprintf() will
overflow. I've added a check and changed the sprintf() to snprintf().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/cxt1e1')
| -rw-r--r-- | drivers/staging/cxt1e1/linux.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/staging/cxt1e1/linux.c b/drivers/staging/cxt1e1/linux.c index 0ff2865edec8..a829b6231a66 100644 --- a/drivers/staging/cxt1e1/linux.c +++ b/drivers/staging/cxt1e1/linux.c @@ -773,7 +773,9 @@ do_del_chan (struct net_device * musycc_dev, void *data) if (copy_from_user (&cp, data, sizeof (struct sbecom_chan_param))) return -EFAULT; - sprintf (buf, CHANNAME "%d", cp.channum); + if (cp.channum > 999) + return -EINVAL; + snprintf (buf, sizeof(buf), CHANNAME "%d", cp.channum); if (!(dev = dev_get_by_name (&init_net, buf))) return -ENOENT; dev_put (dev); |