aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorKarsten Keil <kkeil@suse.de>2007-10-08 06:52:09 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-10-08 16:01:21 -0400
commitd39d5ed97e2b8e089f85ffaf5909768d83147be0 (patch)
tree9fd0a0aefec9e58f71ed343452242b2685dca9d1 /drivers
parente46dc1dab969550d4136e9be0e7919ca09e49573 (diff)
ISDN: Fix data access out of array bounds
Fix against access random data bytes outside the dev->chanmap array. Thanks to Oliver Neukum for pointing me to this issue. Signed-off-by: Karsten Keil <kkeil@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/isdn/i4l/isdn_common.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index ec5f4046412f..4910bca52640 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1135,7 +1135,7 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off)
1135 if (count > dev->drv[drvidx]->stavail) 1135 if (count > dev->drv[drvidx]->stavail)
1136 count = dev->drv[drvidx]->stavail; 1136 count = dev->drv[drvidx]->stavail;
1137 len = dev->drv[drvidx]->interface->readstat(buf, count, 1137 len = dev->drv[drvidx]->interface->readstat(buf, count,
1138 drvidx, isdn_minor2chan(minor)); 1138 drvidx, isdn_minor2chan(minor - ISDN_MINOR_CTRL));
1139 if (len < 0) { 1139 if (len < 0) {
1140 retval = len; 1140 retval = len;
1141 goto out; 1141 goto out;
@@ -1207,7 +1207,8 @@ isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off
1207 */ 1207 */
1208 if (dev->drv[drvidx]->interface->writecmd) 1208 if (dev->drv[drvidx]->interface->writecmd)
1209 retval = dev->drv[drvidx]->interface-> 1209 retval = dev->drv[drvidx]->interface->
1210 writecmd(buf, count, drvidx, isdn_minor2chan(minor)); 1210 writecmd(buf, count, drvidx,
1211 isdn_minor2chan(minor - ISDN_MINOR_CTRL));
1211 else 1212 else
1212 retval = count; 1213 retval = count;
1213 goto out; 1214 goto out;