2.6.23 patches

diff --git a/queue-2.6.23/isdn-avoid-copying-overly-long-strings.patch b/queue-2.6.23/isdn-avoid-copying-overly-long-strings.patch
new file mode 100644 (file)
index 0000000..80ef791
--- /dev/null
+++ b/queue-2.6.23/isdn-avoid-copying-overly-long-strings.patch
@@ -0,0 +1,59 @@
+From 0f13864e5b24d9cbe18d125d41bfa4b726a82e40 Mon Sep 17 00:00:00 2001
+From: Karsten Keil <kkeil@suse.de>
+Date: Thu, 22 Nov 2007 12:43:13 +0100
+Subject: isdn: avoid copying overly-long strings
+Message-ID: <20071122120142.GA2407@pingi.kke.suse.de>
+
+From: Karsten Keil <kkeil@suse.de>
+
+patch 0f13864e5b24d9cbe18d125d41bfa4b726a82e40 in mainline.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9416
+
+Signed-off-by: Karsten Keil <kkeil@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/i4l/isdn_net.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/isdn/i4l/isdn_net.c
++++ b/drivers/isdn/i4l/isdn_net.c
+@@ -2126,7 +2126,7 @@ isdn_net_find_icall(int di, int ch, int 
+       u_long flags;
+       isdn_net_dev *p;
+       isdn_net_phone *n;
+-      char nr[32];
++      char nr[ISDN_MSNLEN];
+       char *my_eaz;
+ 
+       /* Search name in netdev-chain */
+@@ -2135,7 +2135,7 @@ isdn_net_find_icall(int di, int ch, int 
+               nr[1] = '\0';
+               printk(KERN_INFO "isdn_net: Incoming call without OAD, assuming '0'\n");
+       } else
+-              strcpy(nr, setup->phone);
++              strlcpy(nr, setup->phone, ISDN_MSNLEN);
+       si1 = (int) setup->si1;
+       si2 = (int) setup->si2;
+       if (!setup->eazmsn[0]) {
+@@ -2802,7 +2802,7 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg
+                               chidx = -1;
+                       }
+               }
+-              strcpy(lp->msn, cfg->eaz);
++              strlcpy(lp->msn, cfg->eaz, sizeof(lp->msn));
+               lp->pre_device = drvidx;
+               lp->pre_channel = chidx;
+               lp->onhtime = cfg->onhtime;
+@@ -2951,7 +2951,7 @@ isdn_net_addphone(isdn_net_ioctl_phone *
+       if (p) {
+               if (!(n = kmalloc(sizeof(isdn_net_phone), GFP_KERNEL)))
+                       return -ENOMEM;
+-              strcpy(n->num, phone->phone);
++              strlcpy(n->num, phone->phone, sizeof(n->num));
+               n->next = p->local->phone[phone->outgoing & 1];
+               p->local->phone[phone->outgoing & 1] = n;
+               return 0;

diff --git a/queue-2.6.23/series b/queue-2.6.23/series
index 7353d4bd089f06d6c5ffa45c89ec9baf5bf94f65..f45b2f932d8238cd0b528e614181df602955e4f5 100644 (file)
--- a/queue-2.6.23/series
+++ b/queue-2.6.23/series
@@ -25,3 +25,4 @@ kvm-skip-pio-instruction-when-it-is-emulated-not-executed.patch
 kvm-vmx-force-vm86-mode-if-setting-flags-during-real-mode.patch
 kvm-vmx-reset-mmu-context-when-entering-real-mode.patch
 x86-setup-add-a-near-jump-to-serialize-cr0-on-386-486.patch
+isdn-avoid-copying-overly-long-strings.patch