lkml.org 
[lkml]   [1997]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: buffer-overflow in isdn
From
Date
Marc Lehmann <pcg@goof.com> writes:

> in the isdn driver, the routine isdn_tty.c:isdn_tty_parse_at
> copies the string after "ATD" into a 40 byte buffer on the stack,
> without checking for overflows.


Here is a fix for it. It fixes another potential buffer overflow too.
This patch should be integrated in 2.0.32.


-Andi

===================================================================
RCS file: /vger/u4/cvs/linux/drivers/isdn/isdn_tty.c,v
retrieving revision 1.17
diff -u -u -r1.17 isdn_tty.c
--- drivers/net/isdn/isdn_tty.c 1997/09/20 22:58:58 1.17
+++ drivers/net/isdn/isdn_tty.c 1997/11/16 12:46:35
@@ -2445,11 +2445,11 @@
* Get phone-number from modem-commandbuffer
*/
static void
-isdn_tty_getdial(char *p, char *q)
+isdn_tty_getdial(char *p, char *q,int cnt)
{
int first = 1;

- while (strchr("0123456789,#.*WPTS-", *p) && *p) {
+ while (strchr("0123456789,#.*WPTS-", *p) && *p && --cnt>0) {
if ((*p >= '0' && *p <= '9') || ((*p == 'S') && first))
*q++ = *p;
p++;
@@ -2589,7 +2589,7 @@
m->mdmreg[i], ((i + 1) % 10) ? " " : "\r\n");
isdn_tty_at_cout(rb, info);
}
- sprintf(rb, "\r\nEAZ/MSN: %s\r\n",
+ sprintf(rb, "\r\nEAZ/MSN: %.50s\r\n",
strlen(m->msn) ? m->msn : "None");
isdn_tty_at_cout(rb, info);
break;
@@ -3092,7 +3092,7 @@
break;
case 'D':
/* D - Dial */
- isdn_tty_getdial(++p, ds);
+ isdn_tty_getdial(++p, ds, sizeof ds);
p += strlen(p);
if (!strlen(m->msn))
isdn_tty_modem_result(10, info);


\
 
 \ /
  Last update: 2005-03-22 13:40    [from the cache]
©2003-2011 Jasper Spaans. Advertise on this site