From patchwork Sat Sep 4 18:38:59 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 63801 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 65BFEB710B for ; Sun, 5 Sep 2010 04:39:52 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753065Ab0IDSjd (ORCPT ); Sat, 4 Sep 2010 14:39:33 -0400 Received: from mail-bw0-f46.google.com ([209.85.214.46]:57949 "EHLO mail-bw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752794Ab0IDSjc (ORCPT ); Sat, 4 Sep 2010 14:39:32 -0400 Received: by bwz11 with SMTP id 11so2412385bwz.19 for ; Sat, 04 Sep 2010 11:39:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:mime-version:content-type:content-disposition:user-agent; bh=b2bmlHIFCg3PjkEUQQ/ia4IsaMQleTCxTMVYEDGZhzo=; b=o3dTq24I5o4mb0DJhV9Dqcu6Hkjl6UR5tBzTsUGO/2w6XXZXNUt1edZ3Qx+7intj6N hOBv4ylFWiyqNwLBq8/GZcvnwSN1WwvOhAgxzkC7aLkQoAB0heFzEJ+f+0vGCP/RQv65 2EpyKrLpq1eD1r+AN47FOlhHG7daNWB/K1l14= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:user-agent; b=CvgQEt5BfO9WY+VSNAwEIh4Ze1Ds361/QFExMvS16oUa0bnrUTRzxQyAmqGUm/T1ON Qym6vTQB/rW1JC44NX9p0uklweLMsPkDHYDMXj85w2EG45dWA4sm/87eag+F7qwKms2A McjbzgQtyM1GM6025um38KQuC1PGOZec/LzJo= Received: by 10.204.127.75 with SMTP id f11mr1665215bks.85.1283625570539; Sat, 04 Sep 2010 11:39:30 -0700 (PDT) Received: from bicker ([205.177.176.130]) by mx.google.com with ESMTPS id x19sm2645790bkv.21.2010.09.04.11.39.21 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sat, 04 Sep 2010 11:39:29 -0700 (PDT) Date: Sat, 4 Sep 2010 20:38:59 +0200 From: Dan Carpenter To: Karsten Keil Cc: netdev@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] isdn: potential buffer overflows Message-ID: <20100904183806.GO5437@bicker> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org cs->ics.parm.setup.phone is a 32 character array. In each of these cases we're copying from a 35 character array into a 32 character array so we should use strlcpy() instead of strcpy(). Signed-off-by: Dan Carpenter --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/isdn/divert/isdn_divert.c b/drivers/isdn/divert/isdn_divert.c index 70cf6ba..48e6d22 100644 --- a/drivers/isdn/divert/isdn_divert.c +++ b/drivers/isdn/divert/isdn_divert.c @@ -77,7 +77,7 @@ static void deflect_timer_expire(ulong arg) case DEFLECT_ALERT: cs->ics.command = ISDN_CMD_REDIR; /* protocol */ - strcpy(cs->ics.parm.setup.phone,cs->deflect_dest); + strlcpy(cs->ics.parm.setup.phone, cs->deflect_dest, sizeof(cs->ics.parm.setup.phone)); strcpy(cs->ics.parm.setup.eazmsn,"Testtext delayed"); divert_if.ll_cmd(&cs->ics); spin_lock_irqsave(&divert_lock, flags); @@ -251,7 +251,7 @@ int deflect_extern_action(u_char cmd, ulong callid, char *to_nr) case 2: /* redir */ del_timer(&cs->timer); - strcpy(cs->ics.parm.setup.phone, to_nr); + strlcpy(cs->ics.parm.setup.phone, to_nr, sizeof(cs->ics.parm.setup.phone)); strcpy(cs->ics.parm.setup.eazmsn, "Testtext manual"); ic.command = ISDN_CMD_REDIR; if ((i = divert_if.ll_cmd(&ic))) @@ -480,7 +480,7 @@ static int isdn_divert_icall(isdn_ctrl *ic) if (!cs->timer.expires) { strcpy(ic->parm.setup.eazmsn,"Testtext direct"); ic->parm.setup.screen = dv->rule.screen; - strcpy(ic->parm.setup.phone,dv->rule.to_nr); + strlcpy(ic->parm.setup.phone, dv->rule.to_nr, sizeof(ic->parm.setup.phone)); cs->akt_state = DEFLECT_AUTODEL; /* delete after timeout */ cs->timer.expires = jiffies + (HZ * AUTODEL_TIME); retval = 5;