| From foo@baz Thu Apr 10 22:03:05 PDT 2014 |
| From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> |
| Date: Wed, 2 Apr 2014 12:48:42 +0900 |
| Subject: isdnloop: Validate NUL-terminated strings from user. |
| |
| From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> |
| |
| [ Upstream commit 77bc6bed7121936bb2e019a8c336075f4c8eef62 ] |
| |
| Return -EINVAL unless all of user-given strings are correctly |
| NUL-terminated. |
| |
| Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/isdn/isdnloop/isdnloop.c | 6 ++++++ |
| 1 file changed, 6 insertions(+) |
| |
| --- a/drivers/isdn/isdnloop/isdnloop.c |
| +++ b/drivers/isdn/isdnloop/isdnloop.c |
| @@ -1070,6 +1070,12 @@ isdnloop_start(isdnloop_card *card, isdn |
| return -EBUSY; |
| if (copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef))) |
| return -EFAULT; |
| + |
| + for (i = 0; i < 3; i++) { |
| + if (!memchr(sdef.num[i], 0, sizeof(sdef.num[i]))) |
| + return -EINVAL; |
| + } |
| + |
| spin_lock_irqsave(&card->isdnloop_lock, flags); |
| switch (sdef.ptype) { |
| case ISDN_PTYPE_EURO: |
