| commit | dca534e30153c276dcfb50a1196c4f9f26477de5 | |
| author | Dan Carpenter <dan.carpenter@oracle.com> | |
| Wed, 22 May 2019 08:45:13 +0000 (22 11:45 +0300) | ||
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| Sat, 22 Jun 2019 06:16:16 +0000 (22 08:16 +0200) | ||
| tree | bae6fef28a7f7ea43be32abbbd03315b08c30f61 | treesnapshot (tar.gz zip) |
| parent | 8a58d4a26b351c32abee35697ff6eca976ea701a | commitdiff |
mISDN: make sure device name is NUL terminated
[ Upstream commit ccfb62f27beb295103e9392462b20a6ed807d0ea ]
The user can change the device_name with the IMSETDEVNAME ioctl, but we
need to ensure that the user's name is NUL terminated. Otherwise it
could result in a buffer overflow when we copy the name back to the user
with IMGETDEVINFO ioctl.
I also changed two strcpy() calls which handle the name to strscpy().
Hopefully, there aren't any other ways to create a too long name, but
it's nice to do this as a kernel hardening measure.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ccfb62f27beb295103e9392462b20a6ed807d0ea ]
The user can change the device_name with the IMSETDEVNAME ioctl, but we
need to ensure that the user's name is NUL terminated. Otherwise it
could result in a buffer overflow when we copy the name back to the user
with IMGETDEVINFO ioctl.
I also changed two strcpy() calls which handle the name to strscpy().
Hopefully, there aren't any other ways to create a too long name, but
it's nice to do this as a kernel hardening measure.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| drivers/isdn/mISDN/socket.c | diffblobblamehistory |