Skip to content
Commit f3947936 authored by Chen Gang's avatar Chen Gang Committed by David S. Miller
Browse files

drivers/isdn: checkng length to be sure not memory overflow



sizeof (cmd.parm.cmsg.para) is 50 (MAX_CAPI_PARA_LEN).
  sizeof (cmd.parm) is 80+, but less than 100.
  strlen(msg) may be more than 80+ (Modem-Commandbuffer, less than 255).
    isdn_tty_send_msg is called by isdn_tty_parse_at
    the relative parameter is m->mdmcmd (atemu *m)
    the relative command may be "+M..."

  so need check the length to be sure not memory overflow.
    cmd.parm is a union, and need keep original valid buffer length no touch

Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2e85d676
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment