aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/isdn
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2011-11-23 21:41:49 -0500
committerDavid S. Miller <davem@davemloft.net>2011-11-29 18:39:36 -0500
commit746ae30f821a8533ffba7769e492f59a96fdbeec (patch)
treee05346d8584aae51cae021b5832aeae53aa311ed /drivers/isdn
parent1281bc256543eb610b14fa95ce1967397931a120 (diff)
isdn: make sure strings are null terminated
These strings come from the user. We strcpy() them inside cf_command() so we should check that they are NULL terminated and return an error if not. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/isdn')
-rw-r--r--drivers/isdn/divert/divert_procfs.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/isdn/divert/divert_procfs.c b/drivers/isdn/divert/divert_procfs.c
index 33ec9e467772..9021182c4b76 100644
--- a/drivers/isdn/divert/divert_procfs.c
+++ b/drivers/isdn/divert/divert_procfs.c
@@ -242,6 +242,12 @@ static int isdn_divert_ioctl_unlocked(struct file *file, uint cmd, ulong arg)
242 case IIOCDOCFINT: 242 case IIOCDOCFINT:
243 if (!divert_if.drv_to_name(dioctl.cf_ctrl.drvid)) 243 if (!divert_if.drv_to_name(dioctl.cf_ctrl.drvid))
244 return (-EINVAL); /* invalid driver */ 244 return (-EINVAL); /* invalid driver */
245 if (strnlen(dioctl.cf_ctrl.msn, sizeof(dioctl.cf_ctrl.msn)) ==
246 sizeof(dioctl.cf_ctrl.msn))
247 return -EINVAL;
248 if (strnlen(dioctl.cf_ctrl.fwd_nr, sizeof(dioctl.cf_ctrl.fwd_nr)) ==
249 sizeof(dioctl.cf_ctrl.fwd_nr))
250 return -EINVAL;
245 if ((i = cf_command(dioctl.cf_ctrl.drvid, 251 if ((i = cf_command(dioctl.cf_ctrl.drvid,
246 (cmd == IIOCDOCFACT) ? 1 : (cmd == IIOCDOCFDIS) ? 0 : 2, 252 (cmd == IIOCDOCFACT) ? 1 : (cmd == IIOCDOCFDIS) ? 0 : 2,
247 dioctl.cf_ctrl.cfproc, 253 dioctl.cf_ctrl.cfproc,