Commit 5dc5503f authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller

isdn: avoid copying too long drvid

"cfg->drvid" comes from the user so there is a possibility they
didn't NUL terminate it properly.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 746ae30f
...@@ -2756,6 +2756,9 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg) ...@@ -2756,6 +2756,9 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
char *c, char *c,
*e; *e;
if (strnlen(cfg->drvid, sizeof(cfg->drvid)) ==
sizeof(cfg->drvid))
return -EINVAL;
drvidx = -1; drvidx = -1;
chidx = -1; chidx = -1;
strcpy(drvid, cfg->drvid); strcpy(drvid, cfg->drvid);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment