diff options
| author | Tilman Schmidt <tilman@imap.cc> | 2014-10-11 13:46:30 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-10-14 15:05:34 -0400 |
| commit | 5362247a42e18ef74e698bb23575c272f8e35375 (patch) | |
| tree | 554176a9ed7964f711456c7dd41427b2bf8dc2dd | |
| parent | 9ea8aa8d5087529210553114b7bc4bf4374ace8f (diff) | |
isdn/capi: prevent index overrun from command_2_index()
The result of the function command_2_index() is used to index two
arrays mnames[] and cpars[] with max. index 0x4e but in its current
form that function can produce results up to 3*(0x9+0x9)+0x7f =
0xb5.
Fix by clamping all result values potentially overrunning the arrays
to zero which is already handled as an invalid value.
Re-spotted with Coverity.
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/isdn/capi/capiutil.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/isdn/capi/capiutil.c b/drivers/isdn/capi/capiutil.c index 4073d1684d07..b501d76209f0 100644 --- a/drivers/isdn/capi/capiutil.c +++ b/drivers/isdn/capi/capiutil.c @@ -207,6 +207,8 @@ static unsigned command_2_index(unsigned c, unsigned sc) c = 0x9 + (c & 0x0f); else if (c == 0x41) c = 0x9 + 0x1; + if (c > 0x18) + c = 0x00; return (sc & 3) * (0x9 + 0x9) + c; } |