git.openpandora.org / pandora-kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ee7ff5f) | patch
isdn/gigaset: limit raw CAPI message dump length
authorTilman Schmidt <tilman@imap.cc>
Sat, 11 Oct 2014 11:46:29 +0000 (13:46 +0200)
committerDavid S. Miller <davem@davemloft.net>
Tue, 14 Oct 2014 19:05:33 +0000 (15:05 -0400)
commit097933ddcd28ef99c116651b20fd2e06717e0f0d
treedaba40194d81bd13eb0689e3668bae0988137a8dtree | snapshot
parentee7ff5fed25711a26da7826071e6ede8af049ad2commit | diff
isdn/gigaset: limit raw CAPI message dump length

In dump_rawmsg, the length field from a received data package was
used unscrutinized, allowing an attacker to control the size of the
allocated buffer and the number of times the output loop iterates.
Fix by limiting to a reasonable value.

Spotted with Coverity.

Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/isdn/gigaset/capi.c diff | blob | history
Pandora Kernel Repository