Re: [PATCH] isdn/capi: avoid index overrun from command_2_index()
David Miller <[email protected]>
| Newsgroups | gmane.linux.network,gmane.linux.isdn.i4l.user |
|---|---|
| Message-ID | <[email protected]> |
From: Tilman Schmidt <[email protected]> Date: Sun, 20 Jul 2014 15:49:12 +0200 (CEST) > The result of the function command_2_index() is used to index two > arrays mnames[] and cpars[] with max. index 0x4e but in its current > form that function can produce results up to 3*(0x9+0x9)+0x7f = 0xb5. > Legal values for the function's first argument (c) according to the > CAPI 2.0 standard are 0x00..0x08, 0x41, 0x80, 0x82..0x88, and 0xff. > This patch modifies command_2_index() in such a way that the result > is unchanged for legal values of c, and guaranteed to be less or > equal to 0x4e for any argument values. > > Reported-by: Dan Carpenter <[email protected]> > Signed-off-by: Tilman Schmidt <[email protected]> Command value validation should occur at the callers, signalling errors if invalid values are seen, and command_2_index() should BUG_ON() such invalid values.