From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Tue, 11 Dec 2007 23:29:45 +0000 (-0800)
Subject: 2.6.23 patches
X-Git-Tag: v2.6.23.10~17
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=01a1300171e9a9baa00440a7026e29df969f21d3;p=thirdparty%2Fkernel%2Fstable-queue.git

2.6.23 patches
---

diff --git a/queue-2.6.23/isdn-avoid-copying-overly-long-strings.patch b/queue-2.6.23/isdn-avoid-copying-overly-long-strings.patch
new file mode 100644
index 00000000000..80ef79114c6
--- /dev/null
+++ b/queue-2.6.23/isdn-avoid-copying-overly-long-strings.patch
@@ -0,0 +1,59 @@
+From 0f13864e5b24d9cbe18d125d41bfa4b726a82e40 Mon Sep 17 00:00:00 2001
+From: Karsten Keil <kkeil@suse.de>
+Date: Thu, 22 Nov 2007 12:43:13 +0100
+Subject: isdn: avoid copying overly-long strings
+Message-ID: <20071122120142.GA2407@pingi.kke.suse.de>
+
+From: Karsten Keil <kkeil@suse.de>
+
+patch 0f13864e5b24d9cbe18d125d41bfa4b726a82e40 in mainline.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9416
+
+Signed-off-by: Karsten Keil <kkeil@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/i4l/isdn_net.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/isdn/i4l/isdn_net.c
++++ b/drivers/isdn/i4l/isdn_net.c
+@@ -2126,7 +2126,7 @@ isdn_net_find_icall(int di, int ch, int 
+ 	u_long flags;
+ 	isdn_net_dev *p;
+ 	isdn_net_phone *n;
+-	char nr[32];
++	char nr[ISDN_MSNLEN];
+ 	char *my_eaz;
+ 
+ 	/* Search name in netdev-chain */
+@@ -2135,7 +2135,7 @@ isdn_net_find_icall(int di, int ch, int 
+ 		nr[1] = '\0';
+ 		printk(KERN_INFO "isdn_net: Incoming call without OAD, assuming '0'\n");
+ 	} else
+-		strcpy(nr, setup->phone);
++		strlcpy(nr, setup->phone, ISDN_MSNLEN);
+ 	si1 = (int) setup->si1;
+ 	si2 = (int) setup->si2;
+ 	if (!setup->eazmsn[0]) {
+@@ -2802,7 +2802,7 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg
+ 				chidx = -1;
+ 			}
+ 		}
+-		strcpy(lp->msn, cfg->eaz);
++		strlcpy(lp->msn, cfg->eaz, sizeof(lp->msn));
+ 		lp->pre_device = drvidx;
+ 		lp->pre_channel = chidx;
+ 		lp->onhtime = cfg->onhtime;
+@@ -2951,7 +2951,7 @@ isdn_net_addphone(isdn_net_ioctl_phone *
+ 	if (p) {
+ 		if (!(n = kmalloc(sizeof(isdn_net_phone), GFP_KERNEL)))
+ 			return -ENOMEM;
+-		strcpy(n->num, phone->phone);
++		strlcpy(n->num, phone->phone, sizeof(n->num));
+ 		n->next = p->local->phone[phone->outgoing & 1];
+ 		p->local->phone[phone->outgoing & 1] = n;
+ 		return 0;
diff --git a/queue-2.6.23/series b/queue-2.6.23/series
index 7353d4bd089..f45b2f932d8 100644
--- a/queue-2.6.23/series
+++ b/queue-2.6.23/series
@@ -25,3 +25,4 @@ kvm-skip-pio-instruction-when-it-is-emulated-not-executed.patch
 kvm-vmx-force-vm86-mode-if-setting-flags-during-real-mode.patch
 kvm-vmx-reset-mmu-context-when-entering-real-mode.patch
 x86-setup-add-a-near-jump-to-serialize-cr0-on-386-486.patch
+isdn-avoid-copying-overly-long-strings.patch