linux_dsm_epyc7002/drivers/isdn
Dan Carpenter b7a314054e isdn: icn: buffer overflow in icn_command()
This buffer over was detected using static analysis:

	drivers/isdn/icn/icn.c:1325 icn_command()
	error: format string overflow. buf_size: 60 length: 98

The calculation for the length of the string is off because it assumes
that the dial[] buffer holds a 50 character string, but actually it is
at most 31 characters and NUL.  I have removed the dial[] buffer because
it isn't needed.

The maximum length of the string is actually 79 characters and a NUL.  I
have made the cbuf[] array large enough to hold it and changed the
sprintf() to an snprintf() as a further safety enhancement.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-16 15:24:15 -04:00
..
act2000 isdn: replace del_timer by del_timer_sync 2014-03-27 15:28:06 -04:00
capi isdn/capi: Make Middleware depend on CAPI2.0 2014-03-18 15:02:57 -04:00
divert isdn: divert, hysdn: fix interruptible_sleep_on race 2014-02-26 16:06:13 -05:00
gigaset Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-05-01 17:51:54 -07:00
hardware isdn: remove deprecated IRQF_DISABLED 2013-10-17 15:13:20 -04:00
hisax isdn: hisax/elsa: fix sleep_on race in elsa FSM 2014-02-26 16:06:13 -05:00
hysdn isdn: divert, hysdn: fix interruptible_sleep_on race 2014-02-26 16:06:13 -05:00
i4l net: isdn: use sk_unattached_filter api 2014-03-31 00:45:09 -04:00
icn isdn: icn: buffer overflow in icn_command() 2014-04-16 15:24:15 -04:00
isdnloop isdnloop: several buffer overflows 2014-04-08 12:41:13 -04:00
mISDN Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-01-25 11:17:34 -08:00
pcbit isdn: pcbit: fix interruptible_sleep_on race 2014-02-26 16:06:12 -05:00
sc isdn: replace del_timer by del_timer_sync 2014-03-27 15:28:06 -04:00
Kconfig tty: Added a CONFIG_TTY option to allow removal of TTY 2013-01-18 16:15:27 -08:00
Makefile