]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e50b053) | patch
isdn/gigaset: limit raw CAPI message dump length
authorTilman Schmidt <tilman@imap.cc>
Sat, 11 Oct 2014 11:46:29 +0000 (13:46 +0200)
committerDavid S. Miller <davem@davemloft.net>
Tue, 14 Oct 2014 19:05:33 +0000 (15:05 -0400)
commit0bd2cc26a84d23166ab48ea83e107f9f625c9a67
treedaba40194d81bd13eb0689e3668bae0988137a8dtree | snapshot
parente50b0532c4dbf0ed67838d7dcf0a0e658ee0d75dcommit | diff
isdn/gigaset: limit raw CAPI message dump length

In dump_rawmsg, the length field from a received data package was
used unscrutinized, allowing an attacker to control the size of the
allocated buffer and the number of times the output loop iterates.
Fix by limiting to a reasonable value.

Spotted with Coverity.

Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/isdn/gigaset/capi.c diff | blob | history
Linux Kernel Source Tree.