2 files changed, 9 insertions, 0 deletions

diff --git a/drivers/isdn/divert/divert_procfs.c b/drivers/isdn/divert/divert_procfs.c
index 33ec9e467772..9021182c4b76 100644
--- a/drivers/isdn/divert/divert_procfs.c
+++ b/drivers/isdn/divert/divert_procfs.c
@@ -242,6 +242,12 @@ static int isdn_divert_ioctl_unlocked(struct file *file, uint cmd, ulong arg)
                 case IIOCDOCFINT:
                         if (!divert_if.drv_to_name(dioctl.cf_ctrl.drvid))
                                 return (-EINVAL);       /* invalid driver */
+                        if (strnlen(dioctl.cf_ctrl.msn, sizeof(dioctl.cf_ctrl.msn)) ==
+                                        sizeof(dioctl.cf_ctrl.msn))
+                                return -EINVAL;
+                        if (strnlen(dioctl.cf_ctrl.fwd_nr, sizeof(dioctl.cf_ctrl.fwd_nr)) ==
+                                        sizeof(dioctl.cf_ctrl.fwd_nr))
+                                return -EINVAL;
                         if ((i = cf_command(dioctl.cf_ctrl.drvid,
                                             (cmd == IIOCDOCFACT) ? 1 : (cmd == IIOCDOCFDIS) ? 0 : 2,
                                             dioctl.cf_ctrl.cfproc,
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index 1f73d7f7e024..2339d7396b9e 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -2756,6 +2756,9 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
                         char *c,
                         *e;
 
+                        if (strnlen(cfg->drvid, sizeof(cfg->drvid)) ==
+                                        sizeof(cfg->drvid))
+                                return -EINVAL;
                         drvidx = -1;
                         chidx = -1;
                         strcpy(drvid, cfg->drvid);