From: Karsten Keil Date: Mon, 8 Oct 2007 10:52:09 +0000 (+0200) Subject: ISDN: Fix data access out of array bounds X-Git-Tag: v2.6.23~5 X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?p=pandora-kernel.git;a=commitdiff_plain;h=d39d5ed97e2b8e089f85ffaf5909768d83147be0 ISDN: Fix data access out of array bounds Fix against access random data bytes outside the dev->chanmap array. Thanks to Oliver Neukum for pointing me to this issue. Signed-off-by: Karsten Keil Signed-off-by: Linus Torvalds --- diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c index ec5f4046412f..4910bca52640 100644 --- a/drivers/isdn/i4l/isdn_common.c +++ b/drivers/isdn/i4l/isdn_common.c @@ -1135,7 +1135,7 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off) if (count > dev->drv[drvidx]->stavail) count = dev->drv[drvidx]->stavail; len = dev->drv[drvidx]->interface->readstat(buf, count, - drvidx, isdn_minor2chan(minor)); + drvidx, isdn_minor2chan(minor - ISDN_MINOR_CTRL)); if (len < 0) { retval = len; goto out; @@ -1207,7 +1207,8 @@ isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off */ if (dev->drv[drvidx]->interface->writecmd) retval = dev->drv[drvidx]->interface-> - writecmd(buf, count, drvidx, isdn_minor2chan(minor)); + writecmd(buf, count, drvidx, + isdn_minor2chan(minor - ISDN_MINOR_CTRL)); else retval = count; goto out;