Dan Carpenter 7bcc6738ee ISDN: pcbit: off by one bugs in pcbit_set_msn() ... 1) We don't allocate enough space for the NUL terminator so we end up corrupting one character beyond the end of the buffer. 2) The "len - 1" should just be "len". The code is trying to copy a word from a buffer up to a comma or the last word in the buffer. Say you have the buffer, "foo,bar,baz", then this code truncates the last letter off each word so you get "fo", "ba", and "ba". You would hope this kind of bug would get noticed in testing... I'm not very familiar with this code and I can't test it, but I think we should copy the final character. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-07-31 22:14:54 -07:00
..
callbacks.c	isdn: whitespace coding style cleanup	2012-02-21 09:04:01 -08:00
callbacks.h	isdn: whitespace coding style cleanup	2012-02-21 09:04:01 -08:00
capi.c	isdn: whitespace coding style cleanup	2012-02-21 09:04:01 -08:00
capi.h	isdn: whitespace coding style cleanup	2012-02-21 09:04:01 -08:00
drv.c	ISDN: pcbit: off by one bugs in pcbit_set_msn()	2014-07-31 22:14:54 -07:00
edss1.c	isdn: whitespace coding style cleanup	2012-02-21 09:04:01 -08:00
edss1.h	isdn: whitespace coding style cleanup	2012-02-21 09:04:01 -08:00
Kconfig
layer2.c	isdn: Fix typo in drivers/isdn	2012-11-09 17:10:16 -05:00
layer2.h	isdn: whitespace coding style cleanup	2012-02-21 09:04:01 -08:00
Makefile
module.c	isdn: whitespace coding style cleanup	2012-02-21 09:04:01 -08:00
pcbit.h	isdn: whitespace coding style cleanup	2012-02-21 09:04:01 -08:00