* [patch] isdnloop: use strlcpy() instead of strcpy()
@ 2013-11-14 8:21 Dan Carpenter
2013-11-14 21:50 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2013-11-14 8:21 UTC (permalink / raw)
To: netdev, Karsten Keil; +Cc: kernel-janitors, isdn4linux
These strings come from a copy_from_user() and there is no way to be
sure they are NUL terminated.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index baf2686..02125e6 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -1083,8 +1083,10 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
spin_unlock_irqrestore(&card->isdnloop_lock, flags);
return -ENOMEM;
}
- for (i = 0; i < 3; i++)
- strcpy(card->s0num[i], sdef.num[i]);
+ for (i = 0; i < 3; i++) {
+ strlcpy(card->s0num[i], sdef.num[i],
+ sizeof(card->s0num[0]));
+ }
break;
case ISDN_PTYPE_1TR6:
if (isdnloop_fake(card, "DRV1.04TC-1TR6-CAPI-CNS-BASIS-29.11.95",
@@ -1097,7 +1099,7 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
spin_unlock_irqrestore(&card->isdnloop_lock, flags);
return -ENOMEM;
}
- strcpy(card->s0num[0], sdef.num[0]);
+ strlcpy(card->s0num[0], sdef.num[0], sizeof(card->s0num[0]));
card->s0num[1][0] = '\0';
card->s0num[2][0] = '\0';
break;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch] isdnloop: use strlcpy() instead of strcpy()
2013-11-14 8:21 [patch] isdnloop: use strlcpy() instead of strcpy() Dan Carpenter
@ 2013-11-14 21:50 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2013-11-14 21:50 UTC (permalink / raw)
To: dan.carpenter; +Cc: netdev, isdn, kernel-janitors, isdn4linux
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 14 Nov 2013 11:21:10 +0300
> These strings come from a copy_from_user() and there is no way to be
> sure they are NUL terminated.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied and queued up for -stable, thanks Dan.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-11-14 21:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-14 8:21 [patch] isdnloop: use strlcpy() instead of strcpy() Dan Carpenter
2013-11-14 21:50 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).