[patch] telephony: ijx: buffer overflow in ixj_write_cid()

[patch] telephony: ijx: buffer overflow in ixj_write_cid()

[Dan Carpenter]

We get this from user space and nothing has been done to ensure that
these strings are NUL terminated.

Cc: stable@vger.kernel.org
Reported-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This driver is going to be removed in the 3.8 kernel but the fix is
needed for 3.7 and older.

diff --git a/drivers/staging/telephony/ixj.c b/drivers/staging/telephony/ixj.c
index 1cfa0b0..cf6aa83 100644
--- a/drivers/staging/telephony/ixj.c
+++ b/drivers/staging/telephony/ixj.c
@@ -3190,12 +3190,12 @@ static void ixj_write_cid(IXJ *j)
 
 	ixj_fsk_alloc(j);
 
-	strcpy(sdmf1, j->cid_send.month);
-	strcat(sdmf1, j->cid_send.day);
-	strcat(sdmf1, j->cid_send.hour);
-	strcat(sdmf1, j->cid_send.min);
-	strcpy(sdmf2, j->cid_send.number);
-	strcpy(sdmf3, j->cid_send.name);
+	strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
+	strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
+	strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
 
 	len1 = strlen(sdmf1);
 	len2 = strlen(sdmf2);
@@ -3340,12 +3340,12 @@ static void ixj_write_cidcw(IXJ *j)
 		ixj_pre_cid(j);
 	}
 	j->flags.cidcw_ack = 0;
-	strcpy(sdmf1, j->cid_send.month);
-	strcat(sdmf1, j->cid_send.day);
-	strcat(sdmf1, j->cid_send.hour);
-	strcat(sdmf1, j->cid_send.min);
-	strcpy(sdmf2, j->cid_send.number);
-	strcpy(sdmf3, j->cid_send.name);
+	strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
+	strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
+	strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
 
 	len1 = strlen(sdmf1);
 	len2 = strlen(sdmf2);

Re: [patch] telephony: ijx: buffer overflow in ixj_write_cid()

[Greg Kroah-Hartman]

On Mon, Dec 03, 2012 at 10:05:12PM +0300, Dan Carpenter wrote:
> We get this from user space and nothing has been done to ensure that
> these strings are NUL terminated.
> 
> Cc: stable@vger.kernel.org
> Reported-by: Chen Gang <gang.chen@asianux.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> This driver is going to be removed in the 3.8 kernel but the fix is
> needed for 3.7 and older.

Ok, I'll queue it up for 3.7.1 and older stable kernels at that time, as
it's too late for 3.7-final right now, especially as no one is even
using this code :)

thanks,

greg k-h

Re: [patch] telephony: ijx: buffer overflow in ixj_write_cid()

[Chen Gang]

于 2012年12月04日 03:10, Greg Kroah-Hartman 写道:
> On Mon, Dec 03, 2012 at 10:05:12PM +0300, Dan Carpenter wrote:
>> We get this from user space and nothing has been done to ensure that
>> these strings are NUL terminated.
>>
>> Cc: stable@vger.kernel.org
>> Reported-by: Chen Gang <gang.chen@asianux.com>
>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>> ---
>> This driver is going to be removed in the 3.8 kernel but the fix is
>> needed for 3.7 and older.
> 
> Ok, I'll queue it up for 3.7.1 and older stable kernels at that time, as
> it's too late for 3.7-final right now, especially as no one is even
> using this code :)
> 
> thanks,
> 
> greg k-h
> 
> 

  thank you very much.

  :-)

-- 
Chen Gang

Asianux Corporation