Skip to contentSkip to conversation

mISDN: Read buffer overflow

PATCH Applied Roel Kluin 3 participants 3 messages Jul 31, 2009 – Aug 2, 2009

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 mISDN: Read buffer overflow

Check whether index is within bounds before testing the element.

Signed-off-by Roel Kluin <[email protected]>

---

drivers/isdn/mISDN/l1oip_core.c +1 -1
index c3b661a..7e5f30d 100644
@@ -1480,7 +1480,7 @@ l1oip_init(void)
 		return -ENOMEM;
 
 	l1oip_cnt = 0;
-	while (type[l1oip_cnt] && l1oip_cnt < MAX_CARDS) {
+	while (l1oip_cnt < MAX_CARDS && type[l1oip_cnt]) {
 		switch (type[l1oip_cnt] & 0xff) {
 		case 1:
 			pri = 0;
Acked-by on v1 1/1
#1 lore raw

On Freitag, 31. Juli 2009 15:43:59 Roel Kluin wrote:

Ouch !

Acked-by Karsten Keil <[email protected]>
Quoted 17 lines

Check whether index is within bounds before testing the element.

Signed-off-by Roel Kluin <[email protected]>

---

(quoted diff) +0 -0

b/drivers/isdn/mISDN/l1oip_core.c index c3b661a..7e5f30d 100644

drivers/isdn/mISDN/l1oip_core.c +1 -1
@@ -1480,7 +1480,7 @@ l1oip_init(void)
 		return -ENOMEM;
 
 	l1oip_cnt = 0;
-	while (type[l1oip_cnt] && l1oip_cnt < MAX_CARDS) {
+	while (l1oip_cnt < MAX_CARDS && type[l1oip_cnt]) {
 		switch (type[l1oip_cnt] & 0xff) {
 		case 1:
 			pri = 0;