| Message ID | 20101005163448.GH5692@bicker |
|---|---|
| State | Changes Requested, archived |
| Delegated to: | David Miller |
| Headers | show |
On Tue, Oct 05, 2010 at 06:34:48PM +0200, Dan Carpenter wrote: > setup.phone and setup.eazmsn are 32 character buffers. > rcvmsg.msg_data.byte_array is a 48 character buffer. > sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn is 50 chars. > > I changed the strcpy() so strlcpy() because that's safest. ITYM "I papered it over, so potentially broken behaviour is harder to find now"... > - strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4])); > - strcpy(setup.eazmsn, > - sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn); > + strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]), > + sizeof(setup.phone)); OK, so what should be done if the damn array contents _is_ longer than that? > + strlcpy(setup.eazmsn, > + sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn, > + sizeof(setup.eazmsn)); Ditto. > - strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array); > + strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn, > + rcvmsg.msg_data.byte_array, > + sizeof(rcvmsg.msg_data.byte_array)); Huh? Is it or is it not NUL-terminated? If it is, then change is pure cargo-culting; if it is not, you are asking for nasal daemons to fly. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c index 485be8b..288073e 100644 --- a/drivers/isdn/sc/interrupt.c +++ b/drivers/isdn/sc/interrupt.c @@ -114,9 +114,11 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst) { pr_debug("%s: Got Incoming Call\n", sc_adapter[card]->devicename); - strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4])); - strcpy(setup.eazmsn, - sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn); + strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]), + sizeof(setup.phone)); + strlcpy(setup.eazmsn, + sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn, + sizeof(setup.eazmsn)); setup.si1 = 7; setup.si2 = 0; setup.plan = 0; @@ -176,7 +178,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst) * Handle a GetMyNumber Rsp */ if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){ - strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array); + strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn, + rcvmsg.msg_data.byte_array, + sizeof(rcvmsg.msg_data.byte_array)); continue; }
setup.phone and setup.eazmsn are 32 character buffers. rcvmsg.msg_data.byte_array is a 48 character buffer. sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn is 50 chars. I changed the strcpy() so strlcpy() because that's safest. Signed-off-by: Dan Carpenter <error27@gmail.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html