From patchwork Wed Oct 6 05:17:35 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 66896 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3162EB70A6 for ; Wed, 6 Oct 2010 16:17:59 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753515Ab0JFFRx (ORCPT ); Wed, 6 Oct 2010 01:17:53 -0400 Received: from mail-wy0-f174.google.com ([74.125.82.174]:61993 "EHLO mail-wy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751979Ab0JFFRw (ORCPT ); Wed, 6 Oct 2010 01:17:52 -0400 Received: by wyb28 with SMTP id 28so6836142wyb.19 for ; Tue, 05 Oct 2010 22:17:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:references:mime-version:content-type:content-disposition :in-reply-to:user-agent; bh=jh4qcjNDdRu2zW3sLtKdBMVXlQrUsDL+ggLCYEieRZ4=; b=JMw0brEfRukNgEZhzeRj0x0smAvG0M4gHmHk1S7H5Dy8VQiHGRgSwq29wXGrCk+Pvw s7qZus3HFOoM5fJxq9uc+uz8zPO0NvhHsT/KBz+XazIR+wVMCShyaxnceirJyrr6BlqD L/HqzyO1R/h/pk6UGPA6qXsK43f5xXuv083LE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; b=ZFpp8yVenUIb04MyyUXknRDO9DNekgs8dafeKlUthwhskDKvbgZXi0oLjoRqb/5H5F yo4qgSw+Zs08obyIL2LZgOFL8V0gA03DgIf5baVAVWaEt/RKg8361WQ61HAWkxFC9ATJ +pkSQ8S6B2RKp2Qr4PX/fJwWa6/cRrV3aGhHI= Received: by 10.216.7.129 with SMTP id 1mr10095292wep.90.1286342271076; Tue, 05 Oct 2010 22:17:51 -0700 (PDT) Received: from bicker (h3f05.n1.ips.mtn.co.ug [41.210.191.5]) by mx.google.com with ESMTPS id v11sm284196weq.40.2010.10.05.22.17.46 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 05 Oct 2010 22:17:49 -0700 (PDT) Date: Wed, 6 Oct 2010 07:17:35 +0200 From: Dan Carpenter To: Al Viro Cc: Karsten Keil , netdev@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] isdn: strcpy() => strlcpy() Message-ID: <20101006051735.GD5409@bicker> References: <20101005163448.GH5692@bicker> <20101005164306.GP19804@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20101005164306.GP19804@ZenIV.linux.org.uk> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org setup.phone and setup.eazmsn are 32 character buffers. rcvmsg.msg_data.byte_array is a 48 character buffer. sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn is 50 chars. The rcvmsg struct comes from the memcpy_fromio() in receivemessage(). I guess that means it's data off the wire. I'm not very familiar with this code but I don't see any reason to assume these strings are NULL terminated. Also it's weird that "dn" in a 50 character buffer but we only seem to use 32 characters. In drivers/isdn/sc/scioc.h, "dn" is only a 49 character buffer. So potentially there is still an issue there. The important thing for now is to prevent the memory corruption. Signed-off-by: Dan Carpenter --- I don't have this hardware, but this patch should not introduce any bugs that weren't there in the original. v2: If the strlcpy() strings aren't NULL terminated then bail out earlier. Add a better commit message. The first commit message sucked. Sorry for that. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c index 485be8b..f0225bc 100644 --- a/drivers/isdn/sc/interrupt.c +++ b/drivers/isdn/sc/interrupt.c @@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst) } else if(callid>=0x0000 && callid<=0x7FFF) { + int len; + pr_debug("%s: Got Incoming Call\n", sc_adapter[card]->devicename); - strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4])); - strcpy(setup.eazmsn, - sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn); + len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]), + sizeof(setup.phone)); + if (len >= sizeof(setup.phone)) + continue; + len = strlcpy(setup.eazmsn, + sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn, + sizeof(setup.eazmsn)); + if (len >= sizeof(setup.eazmsn)) + continue; setup.si1 = 7; setup.si2 = 0; setup.plan = 0; @@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst) * Handle a GetMyNumber Rsp */ if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){ - strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array); + strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn, + rcvmsg.msg_data.byte_array, + sizeof(rcvmsg.msg_data.byte_array)); continue; }