summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2014-04-16 14:25:16 +0300
committerDavid S. Miller <davem@davemloft.net>2014-04-16 15:24:15 -0400
commitb7a314054eb55e3745a9409beaa5d8be5cd2d273 (patch)
treeeaae9916a4c66d1f81c31d5b876dd04fffea6260 /kernel
parent74462f0d4a734274a04dbbe58099134cbe7a5522 (diff)
downloadlinux-b7a314054eb55e3745a9409beaa5d8be5cd2d273.tar.gz
linux-b7a314054eb55e3745a9409beaa5d8be5cd2d273.tar.bz2
linux-b7a314054eb55e3745a9409beaa5d8be5cd2d273.zip
isdn: icn: buffer overflow in icn_command()
This buffer over was detected using static analysis: drivers/isdn/icn/icn.c:1325 icn_command() error: format string overflow. buf_size: 60 length: 98 The calculation for the length of the string is off because it assumes that the dial[] buffer holds a 50 character string, but actually it is at most 31 characters and NUL. I have removed the dial[] buffer because it isn't needed. The maximum length of the string is actually 79 characters and a NUL. I have made the cbuf[] array large enough to hold it and changed the sprintf() to an snprintf() as a further safety enhancement. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions