staging: cxt1e1: buffer overflow in do_del_chan()

PATCH New Dan Carpenter 1 participant 1 message Jan 24, 2013

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2013-01-24 06:41 UTC #0 lore raw

PATCH 1/1 staging: cxt1e1: buffer overflow in do_del_chan()

If we don't restrict "cp.channum" to 3 digits then the sprintf() will overflow. I've added a check and changed the sprintf() to snprintf().

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/cxt1e1/linux.c +3 -1

index 0ff2865..a829b62 100644
@@ -773,7 +773,9 @@ do_del_chan (struct net_device * musycc_dev, void *data)
     if (copy_from_user (&cp, data,
                         sizeof (struct sbecom_chan_param)))
         return -EFAULT;
-    sprintf (buf, CHANNAME "%d", cp.channum);
+    if (cp.channum > 999)
+        return -EINVAL;
+    snprintf (buf, sizeof(buf), CHANNAME "%d", cp.channum);
     if (!(dev = dev_get_by_name (&init_net, buf)))
         return -ENOENT;
     dev_put (dev);