summaryrefslogtreecommitdiff
path: root/drivers/isdn
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2014-07-31 19:30:11 +0400
committerDavid S. Miller <davem@davemloft.net>2014-08-01 09:14:54 +0400
commit7bcc6738eef36e7139c4293c321bc43f716e8d85 (patch)
tree669276e7cbc4f83d0c79d77ef2cff9dcc318fef4 /drivers/isdn
parente98d69ba464868a5d6b0b43730658810a29ff825 (diff)
downloadlinux-7bcc6738eef36e7139c4293c321bc43f716e8d85.tar.xz
ISDN: pcbit: off by one bugs in pcbit_set_msn()
1) We don't allocate enough space for the NUL terminator so we end up corrupting one character beyond the end of the buffer. 2) The "len - 1" should just be "len". The code is trying to copy a word from a buffer up to a comma or the last word in the buffer. Say you have the buffer, "foo,bar,baz", then this code truncates the last letter off each word so you get "fo", "ba", and "ba". You would hope this kind of bug would get noticed in testing... I'm not very familiar with this code and I can't test it, but I think we should copy the final character. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/isdn')
-rw-r--r--drivers/isdn/pcbit/drv.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/isdn/pcbit/drv.c b/drivers/isdn/pcbit/drv.c
index f02cc506fbfa..4172e22ae7ed 100644
--- a/drivers/isdn/pcbit/drv.c
+++ b/drivers/isdn/pcbit/drv.c
@@ -1035,14 +1035,14 @@ static void pcbit_set_msn(struct pcbit_dev *dev, char *list)
}
ptr->next = NULL;
- ptr->msn = kmalloc(len, GFP_ATOMIC);
+ ptr->msn = kmalloc(len + 1, GFP_ATOMIC);
if (!ptr->msn) {
printk(KERN_WARNING "kmalloc failed\n");
kfree(ptr);
return;
}
- memcpy(ptr->msn, sp, len - 1);
+ memcpy(ptr->msn, sp, len);
ptr->msn[len] = 0;
#ifdef DEBUG