diff options
| author | Chen Gang | 2013-03-07 19:25:41 +0100 |
|---|---|---|
| committer | David S. Miller | 2013-03-08 06:35:44 +0100 |
| commit | f39479363e0361c8bb4397481c01a7c3a1a3c8ac (patch) | |
| tree | b2619455915812602af6c2f19e84d435d9b8ca7c /net/netlabel/netlabel_unlabeled.c | |
| parent | net/rds: zero last byte for strncpy (diff) | |
| download | kernel-qcow2-linux-f39479363e0361c8bb4397481c01a7c3a1a3c8ac.tar.gz kernel-qcow2-linux-f39479363e0361c8bb4397481c01a7c3a1a3c8ac.tar.xz kernel-qcow2-linux-f39479363e0361c8bb4397481c01a7c3a1a3c8ac.zip | |
drivers/isdn: checkng length to be sure not memory overflow
sizeof (cmd.parm.cmsg.para) is 50 (MAX_CAPI_PARA_LEN).
sizeof (cmd.parm) is 80+, but less than 100.
strlen(msg) may be more than 80+ (Modem-Commandbuffer, less than 255).
isdn_tty_send_msg is called by isdn_tty_parse_at
the relative parameter is m->mdmcmd (atemu *m)
the relative command may be "+M..."
so need check the length to be sure not memory overflow.
cmd.parm is a union, and need keep original valid buffer length no touch
Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netlabel/netlabel_unlabeled.c')
0 files changed, 0 insertions, 0 deletions