From: David Miller <davem@davemloft.net>
To: error27@gmail.com
Cc: viro@ZenIV.linux.org.uk, isdn@linux-pingi.de,
netdev@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [patch] isdn: strcpy() => strlcpy()
Date: Fri, 08 Oct 2010 10:23:12 -0700 (PDT) [thread overview]
Message-ID: <20101008.102312.71118938.davem@davemloft.net> (raw)
In-Reply-To: <20101006051735.GD5409@bicker>
From: Dan Carpenter <error27@gmail.com>
Date: Wed, 6 Oct 2010 07:17:35 +0200
> setup.phone and setup.eazmsn are 32 character buffers.
> rcvmsg.msg_data.byte_array is a 48 character buffer.
> sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn is 50 chars.
>
> The rcvmsg struct comes from the memcpy_fromio() in receivemessage().
> I guess that means it's data off the wire. I'm not very familiar with
> this code but I don't see any reason to assume these strings are NULL
> terminated.
>
> Also it's weird that "dn" in a 50 character buffer but we only seem to
> use 32 characters. In drivers/isdn/sc/scioc.h, "dn" is only a 49
> character buffer. So potentially there is still an issue there.
>
> The important thing for now is to prevent the memory corruption.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Applied, thanks Dan.
prev parent reply other threads:[~2010-10-08 17:22 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-10-05 16:34 [patch] isdn: strcpy() => strlcpy() Dan Carpenter
2010-10-05 16:43 ` Al Viro
2010-10-06 5:17 ` Dan Carpenter
2010-10-08 17:23 ` David Miller [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20101008.102312.71118938.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=error27@gmail.com \
--cc=isdn@linux-pingi.de \
--cc=kernel-janitors@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).