Attachment 312419 Details for Bug 392101 – Proposed backported patch for RHEL-3.9

[patch] Proposed backported patch for RHEL-3.9

patch (text/plain), 1.77 KB, created by Eugene Teo (Security Response) on 2008-07-23 05:22:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Teo (Security Response)

Created: 2008-07-23 05:22:09 UTC

Size: 1.77 KB

patch

obsolete

>[RHEL3.9 PATCH] CVE-2007-6063 Linux kernel isdn_net_setcfg buffer overflow
>
>This is for bz#456361.
>
>Backport of upstream commit 0f13864e5b24d9cbe18d125d41bfa4b726a82e40
>
>This patch replaces strcpy with strlcpy where the source strings can be
>controlled from userspace.
>
>Signed-off-by: Eugene Teo <eteo@redhat.com>
>---
> drivers/isdn/isdn_net.c |    8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
>diff -uprN kernel-2.4.21.default/drivers/isdn/isdn_net.c kernel-2.4.21/drivers/isdn/isdn_net.c
>--- kernel-2.4.21.default/drivers/isdn/isdn_net.c	2003-06-13 22:51:34.000000000 +0800
>+++ kernel-2.4.21/drivers/isdn/isdn_net.c	2008-07-23 13:11:15.000000000 +0800
>@@ -2159,7 +2159,7 @@ isdn_net_find_icall(int di, int ch, int 
> 	isdn_net_dev *p;
> 	isdn_net_phone *n;
> 	ulong flags;
>-	char nr[32];
>+	char nr[ISDN_MSNLEN];
> 	char *my_eaz;
> 
> 	/* Search name in netdev-chain */
>@@ -2170,7 +2170,7 @@ isdn_net_find_icall(int di, int ch, int 
> 		nr[1] = '\0';
> 		printk(KERN_INFO "isdn_net: Incoming call without OAD, assuming '0'\n");
> 	} else
>-		strcpy(nr, setup->phone);
>+		strlcpy(nr, setup->phone, ISDN_MSNLEN);
> 	si1 = (int) setup->si1;
> 	si2 = (int) setup->si2;
> 	if (!setup->eazmsn[0]) {
>@@ -2855,7 +2855,7 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg
> 				chidx = -1;
> 			}
> 		}
>-		strcpy(lp->msn, cfg->eaz);
>+		strlcpy(lp->msn, cfg->eaz, sizeof(lp->msn));
> 		lp->pre_device = drvidx;
> 		lp->pre_channel = chidx;
> 		lp->onhtime = cfg->onhtime;
>@@ -3004,7 +3004,7 @@ isdn_net_addphone(isdn_net_ioctl_phone *
> 	if (p) {
> 		if (!(n = (isdn_net_phone *) kmalloc(sizeof(isdn_net_phone), GFP_KERNEL)))
> 			return -ENOMEM;
>-		strcpy(n->num, phone->phone);
>+		strlcpy(n->num, phone->phone, sizeof(n->num));
> 		n->next = p->local->phone[phone->outgoing & 1];
> 		p->local->phone[phone->outgoing & 1] = n;
> 		return 0;

Actions: View | Diff

Attachments on bug 392101: 312419 | 312420