diff options
author | Karsten Keil <kkeil@suse.de> | 2007-10-08 06:52:09 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-10-08 16:01:21 -0400 |
commit | d39d5ed97e2b8e089f85ffaf5909768d83147be0 (patch) | |
tree | 9fd0a0aefec9e58f71ed343452242b2685dca9d1 /drivers | |
parent | e46dc1dab969550d4136e9be0e7919ca09e49573 (diff) |
ISDN: Fix data access out of array bounds
Fix against access random data bytes outside the dev->chanmap array.
Thanks to Oliver Neukum for pointing me to this issue.
Signed-off-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/isdn/i4l/isdn_common.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c index ec5f4046412f..4910bca52640 100644 --- a/drivers/isdn/i4l/isdn_common.c +++ b/drivers/isdn/i4l/isdn_common.c | |||
@@ -1135,7 +1135,7 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off) | |||
1135 | if (count > dev->drv[drvidx]->stavail) | 1135 | if (count > dev->drv[drvidx]->stavail) |
1136 | count = dev->drv[drvidx]->stavail; | 1136 | count = dev->drv[drvidx]->stavail; |
1137 | len = dev->drv[drvidx]->interface->readstat(buf, count, | 1137 | len = dev->drv[drvidx]->interface->readstat(buf, count, |
1138 | drvidx, isdn_minor2chan(minor)); | 1138 | drvidx, isdn_minor2chan(minor - ISDN_MINOR_CTRL)); |
1139 | if (len < 0) { | 1139 | if (len < 0) { |
1140 | retval = len; | 1140 | retval = len; |
1141 | goto out; | 1141 | goto out; |
@@ -1207,7 +1207,8 @@ isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off | |||
1207 | */ | 1207 | */ |
1208 | if (dev->drv[drvidx]->interface->writecmd) | 1208 | if (dev->drv[drvidx]->interface->writecmd) |
1209 | retval = dev->drv[drvidx]->interface-> | 1209 | retval = dev->drv[drvidx]->interface-> |
1210 | writecmd(buf, count, drvidx, isdn_minor2chan(minor)); | 1210 | writecmd(buf, count, drvidx, |
1211 | isdn_minor2chan(minor - ISDN_MINOR_CTRL)); | ||
1211 | else | 1212 | else |
1212 | retval = count; | 1213 | retval = count; |
1213 | goto out; | 1214 | goto out; |