diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2011-11-24 02:42:09 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-11-29 18:39:37 -0500 |
| commit | 5dc5503f5a400be5a7dc611745a034f04b0679b8 (patch) | |
| tree | b717b567bd90f0f637d2d4ed48bea72567126a78 | |
| parent | 746ae30f821a8533ffba7769e492f59a96fdbeec (diff) | |
isdn: avoid copying too long drvid
"cfg->drvid" comes from the user so there is a possibility they
didn't NUL terminate it properly.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/isdn/i4l/isdn_net.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c index 1f73d7f7e02..2339d7396b9 100644 --- a/drivers/isdn/i4l/isdn_net.c +++ b/drivers/isdn/i4l/isdn_net.c @@ -2756,6 +2756,9 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg) char *c, *e; + if (strnlen(cfg->drvid, sizeof(cfg->drvid)) == + sizeof(cfg->drvid)) + return -EINVAL; drvidx = -1; chidx = -1; strcpy(drvid, cfg->drvid); |