linux-hardened/drivers/isdn
Tilman Schmidt 5362247a42 isdn/capi: prevent index overrun from command_2_index()
The result of the function command_2_index() is used to index two
arrays mnames[] and cpars[] with max. index 0x4e but in its current
form that function can produce results up to 3*(0x9+0x9)+0x7f =
0xb5.
Fix by clamping all result values potentially overrunning the arrays
to zero which is already handled as an invalid value.

Re-spotted with Coverity.

Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-14 15:05:34 -04:00
..
act2000 isdn: replace del_timer by del_timer_sync 2014-03-27 15:28:06 -04:00
capi isdn/capi: prevent index overrun from command_2_index() 2014-10-14 15:05:34 -04:00
divert isdn: divert, hysdn: fix interruptible_sleep_on race 2014-02-26 16:06:13 -05:00
gigaset isdn/gigaset: fix non-heap pointer deallocation 2014-10-14 15:05:34 -04:00
hardware drivers: isdn: eicon: xdi_msg.h: Fix typo in #ifndef 2014-08-22 11:31:30 -07:00
hisax isdn: hisax: l3ni1.c: Fix for possible null pointer dereference 2014-07-08 16:06:21 -07:00
hysdn isdn: divert, hysdn: fix interruptible_sleep_on race 2014-02-26 16:06:13 -05:00
i4l isdn: i4l: Remove ASYNC_CTS_FLOW 2014-09-23 21:19:35 -07:00
icn isdn: icn: buffer overflow in icn_command() 2014-04-16 15:24:15 -04:00
isdnloop isdnloop: several buffer overflows 2014-04-08 12:41:13 -04:00
mISDN mISDN: remove DSP_NEVER_DEFINED and adjust code identation 2014-09-05 22:20:21 -07:00
pcbit ISDN: pcbit: off by one bugs in pcbit_set_msn() 2014-07-31 22:14:54 -07:00
sc isdn: replace del_timer by del_timer_sync 2014-03-27 15:28:06 -04:00
Kconfig
Makefile