summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarsten Keil <kkeil@suse.de>2007-10-08 14:52:09 +0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-10-09 00:01:21 +0400
commitd39d5ed97e2b8e089f85ffaf5909768d83147be0 (patch)
tree9fd0a0aefec9e58f71ed343452242b2685dca9d1
parente46dc1dab969550d4136e9be0e7919ca09e49573 (diff)
downloadlinux-d39d5ed97e2b8e089f85ffaf5909768d83147be0.tar.xz
ISDN: Fix data access out of array bounds
Fix against access random data bytes outside the dev->chanmap array. Thanks to Oliver Neukum for pointing me to this issue. Signed-off-by: Karsten Keil <kkeil@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/isdn/i4l/isdn_common.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index ec5f4046412f..4910bca52640 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1135,7 +1135,7 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off)
if (count > dev->drv[drvidx]->stavail)
count = dev->drv[drvidx]->stavail;
len = dev->drv[drvidx]->interface->readstat(buf, count,
- drvidx, isdn_minor2chan(minor));
+ drvidx, isdn_minor2chan(minor - ISDN_MINOR_CTRL));
if (len < 0) {
retval = len;
goto out;
@@ -1207,7 +1207,8 @@ isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off
*/
if (dev->drv[drvidx]->interface->writecmd)
retval = dev->drv[drvidx]->interface->
- writecmd(buf, count, drvidx, isdn_minor2chan(minor));
+ writecmd(buf, count, drvidx,
+ isdn_minor2chan(minor - ISDN_MINOR_CTRL));
else
retval = count;
goto out;