isdnloop: Validate NUL-terminated strings from user.
authorYOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org>
Wed, 2 Apr 2014 03:48:42 +0000 (12:48 +0900)
committerDavid S. Miller <davem@davemloft.net>
Thu, 3 Apr 2014 15:26:24 +0000 (11:26 -0400)
Return -EINVAL unless all of user-given strings are correctly
NUL-terminated.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/isdn/isdnloop/isdnloop.c

index 02125e6a91093e22bda1849bad209f6d3ebe8962..e1f8748ff25dc6716301c7958d935419700e71fc 100644 (file)
@@ -1070,6 +1070,12 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
                return -EBUSY;
        if (copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef)))
                return -EFAULT;
+
+       for (i = 0; i < 3; i++) {
+               if (!memchr(sdef.num[i], 0, sizeof(sdef.num[i])))
+                       return -EINVAL;
+       }
+
        spin_lock_irqsave(&card->isdnloop_lock, flags);
        switch (sdef.ptype) {
        case ISDN_PTYPE_EURO: