isdnloop: use strlcpy() instead of strcpy()
These strings come from a copy_from_user() and there is no way to be sure they are NUL terminated. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
9434266f2c
commit
f9a23c8448
|
@ -1083,8 +1083,10 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
|
|||
spin_unlock_irqrestore(&card->isdnloop_lock, flags);
|
||||
return -ENOMEM;
|
||||
}
|
||||
for (i = 0; i < 3; i++)
|
||||
strcpy(card->s0num[i], sdef.num[i]);
|
||||
for (i = 0; i < 3; i++) {
|
||||
strlcpy(card->s0num[i], sdef.num[i],
|
||||
sizeof(card->s0num[0]));
|
||||
}
|
||||
break;
|
||||
case ISDN_PTYPE_1TR6:
|
||||
if (isdnloop_fake(card, "DRV1.04TC-1TR6-CAPI-CNS-BASIS-29.11.95",
|
||||
|
@ -1097,7 +1099,7 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
|
|||
spin_unlock_irqrestore(&card->isdnloop_lock, flags);
|
||||
return -ENOMEM;
|
||||
}
|
||||
strcpy(card->s0num[0], sdef.num[0]);
|
||||
strlcpy(card->s0num[0], sdef.num[0], sizeof(card->s0num[0]));
|
||||
card->s0num[1][0] = '\0';
|
||||
card->s0num[2][0] = '\0';
|
||||
break;
|
||||
|
|
Loading…
Reference in New Issue