Skip to contentSkip to conversation

telephony: ijx: buffer overflow in ixj_write_cid()

PATCH In review Dan Carpenter 3 participants 3 messages Dec 3, 2012 – Dec 5, 2012

Subsystems (2)
Staging Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 telephony: ijx: buffer overflow in ixj_write_cid()

We get this from user space and nothing has been done to ensure that these strings are NUL terminated.

Cc [email protected]
Reported-by Chen Gang <[email protected]>
Signed-off-by Dan Carpenter <[email protected]>

---
This driver is going to be removed in the 3.8 kernel but the fix is needed for 3.7 and older.

drivers/staging/telephony/ixj.c +12 -12
index 1cfa0b0..cf6aa83 100644
@@ -3190,12 +3190,12 @@ static void ixj_write_cid(IXJ *j)
 
 	ixj_fsk_alloc(j);
 
-	strcpy(sdmf1, j->cid_send.month);
-	strcat(sdmf1, j->cid_send.day);
-	strcat(sdmf1, j->cid_send.hour);
-	strcat(sdmf1, j->cid_send.min);
-	strcpy(sdmf2, j->cid_send.number);
-	strcpy(sdmf3, j->cid_send.name);
+	strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
+	strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
+	strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
 
 	len1 = strlen(sdmf1);
 	len2 = strlen(sdmf2);

@@ -3340,12 +3340,12 @@ static void ixj_write_cidcw(IXJ *j)
 		ixj_pre_cid(j);
 	}
 	j->flags.cidcw_ack = 0;
-	strcpy(sdmf1, j->cid_send.month);
-	strcat(sdmf1, j->cid_send.day);
-	strcat(sdmf1, j->cid_send.hour);
-	strcat(sdmf1, j->cid_send.min);
-	strcpy(sdmf2, j->cid_send.number);
-	strcpy(sdmf3, j->cid_send.name);
+	strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
+	strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
+	strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
+	strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
 
 	len1 = strlen(sdmf1);
 	len2 = strlen(sdmf2);
maintainer
#1 lore raw
Quoted 9 lines · Dan Carpenter

We get this from user space and nothing has been done to ensure that these strings are NUL terminated.

Cc [email protected]
Reported-by Chen Gang <[email protected]>
Signed-off-by Dan Carpenter <[email protected]>

---
This driver is going to be removed in the 3.8 kernel but the fix is needed for 3.7 and older.

Ok, I'll queue it up for 3.7.1 and older stable kernels at that time, as it's too late for 3.7-final right now, especially as no one is even using this code :)

thanks,

greg k-h

#2 lore raw
In reply to Dan Carpenter
Quoted 11 lines · Greg Kroah-Hartman
Quoted 9 lines · Dan Carpenter

We get this from user space and nothing has been done to ensure that these strings are NUL terminated.

Cc [email protected]
Reported-by Chen Gang <[email protected]>
Signed-off-by Dan Carpenter <[email protected]>

---
This driver is going to be removed in the 3.8 kernel but the fix is needed for 3.7 and older.

Quoted 9 lines

Ok, I'll queue it up for 3.7.1 and older stable kernels at that time, as it's too late for 3.7-final right now, especially as no one is even using this code :)

thanks,

greg k-h

thank you very much.

:-)

Signature · 3 lines
Chen Gang

Asianux Corporation