diff options
| author | Karsten Keil <kkeil@suse.de> | 2007-10-08 12:52:09 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-10-08 13:01:21 -0700 |
| commit | d39d5ed97e2b8e089f85ffaf5909768d83147be0 (patch) | |
| tree | 9fd0a0aefec9e58f71ed343452242b2685dca9d1 /drivers | |
| parent | e46dc1dab969550d4136e9be0e7919ca09e49573 (diff) | |
| download | op-kernel-dev-d39d5ed97e2b8e089f85ffaf5909768d83147be0.zip op-kernel-dev-d39d5ed97e2b8e089f85ffaf5909768d83147be0.tar.gz | |
ISDN: Fix data access out of array bounds
Fix against access random data bytes outside the dev->chanmap array.
Thanks to Oliver Neukum for pointing me to this issue.
Signed-off-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/isdn/i4l/isdn_common.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c index ec5f404..4910bca 100644 --- a/drivers/isdn/i4l/isdn_common.c +++ b/drivers/isdn/i4l/isdn_common.c @@ -1135,7 +1135,7 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off) if (count > dev->drv[drvidx]->stavail) count = dev->drv[drvidx]->stavail; len = dev->drv[drvidx]->interface->readstat(buf, count, - drvidx, isdn_minor2chan(minor)); + drvidx, isdn_minor2chan(minor - ISDN_MINOR_CTRL)); if (len < 0) { retval = len; goto out; @@ -1207,7 +1207,8 @@ isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off */ if (dev->drv[drvidx]->interface->writecmd) retval = dev->drv[drvidx]->interface-> - writecmd(buf, count, drvidx, isdn_minor2chan(minor)); + writecmd(buf, count, drvidx, + isdn_minor2chan(minor - ISDN_MINOR_CTRL)); else retval = count; goto out; |
