system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-11-03 01:56:01 +00:00
Code Issues Projects Releases Packages Wiki Activity

ISDN: Fix data access out of array bounds

Browse source 
Fix against access random data bytes outside the dev->chanmap array.
Thanks to Oliver Neukum for pointing me to this issue.

Signed-off-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Karsten Keil 2007-10-08 12:52:09 +02:00 committed by Linus Torvalds
parent e46dc1dab9
commit d39d5ed97e
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/isdn/i4l/isdn_common.c
View file

@ -1135,7 +1135,7 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off)
if (count > dev->drv[drvidx]->stavail)
count = dev->drv[drvidx]->stavail;
len = dev->drv[drvidx]->interface->readstat(buf, count,
drvidx, isdn_minor2chan(minor));
drvidx, isdn_minor2chan(minor - ISDN_MINOR_CTRL));
if (len < 0) {
retval = len;
goto out;
@ -1207,7 +1207,8 @@ isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off
*/
if (dev->drv[drvidx]->interface->writecmd)
retval = dev->drv[drvidx]->interface->
writecmd(buf, count, drvidx, isdn_minor2chan(minor));
writecmd(buf, count, drvidx,
isdn_minor2chan(minor - ISDN_MINOR_CTRL));
else
retval = count;
goto out;