lkml.org 
[lkml]   [1997]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    SubjectRe: buffer-overflow in isdn
    From
    Date
    Marc Lehmann <pcg@goof.com> writes:

    > in the isdn driver, the routine isdn_tty.c:isdn_tty_parse_at
    > copies the string after "ATD" into a 40 byte buffer on the stack,
    > without checking for overflows.


    Here is a fix for it. It fixes another potential buffer overflow too.
    This patch should be integrated in 2.0.32.


    -Andi

    ===================================================================
    RCS file: /vger/u4/cvs/linux/drivers/isdn/isdn_tty.c,v
    retrieving revision 1.17
    diff -u -u -r1.17 isdn_tty.c
    --- drivers/net/isdn/isdn_tty.c 1997/09/20 22:58:58 1.17
    +++ drivers/net/isdn/isdn_tty.c 1997/11/16 12:46:35
    @@ -2445,11 +2445,11 @@
    * Get phone-number from modem-commandbuffer
    */
    static void
    -isdn_tty_getdial(char *p, char *q)
    +isdn_tty_getdial(char *p, char *q,int cnt)
    {
    int first = 1;

    - while (strchr("0123456789,#.*WPTS-", *p) && *p) {
    + while (strchr("0123456789,#.*WPTS-", *p) && *p && --cnt>0) {
    if ((*p >= '0' && *p <= '9') || ((*p == 'S') && first))
    *q++ = *p;
    p++;
    @@ -2589,7 +2589,7 @@
    m->mdmreg[i], ((i + 1) % 10) ? " " : "\r\n");
    isdn_tty_at_cout(rb, info);
    }
    - sprintf(rb, "\r\nEAZ/MSN: %s\r\n",
    + sprintf(rb, "\r\nEAZ/MSN: %.50s\r\n",
    strlen(m->msn) ? m->msn : "None");
    isdn_tty_at_cout(rb, info);
    break;
    @@ -3092,7 +3092,7 @@
    break;
    case 'D':
    /* D - Dial */
    - isdn_tty_getdial(++p, ds);
    + isdn_tty_getdial(++p, ds, sizeof ds);
    p += strlen(p);
    if (!strlen(m->msn))
    isdn_tty_modem_result(10, info);


    \
     
     \ /
      Last update: 2005-03-22 13:40    [W:0.039 / U:59.580 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site