summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTilman Schmidt <tilman@imap.cc>2014-10-11 13:46:30 +0200
committerDavid S. Miller <davem@davemloft.net>2014-10-14 15:05:34 -0400
commit5362247a42e18ef74e698bb23575c272f8e35375 (patch)
tree554176a9ed7964f711456c7dd41427b2bf8dc2dd
parent9ea8aa8d5087529210553114b7bc4bf4374ace8f (diff)
isdn/capi: prevent index overrun from command_2_index()
The result of the function command_2_index() is used to index two arrays mnames[] and cpars[] with max. index 0x4e but in its current form that function can produce results up to 3*(0x9+0x9)+0x7f = 0xb5. Fix by clamping all result values potentially overrunning the arrays to zero which is already handled as an invalid value. Re-spotted with Coverity. Signed-off-by: Tilman Schmidt <tilman@imap.cc> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/isdn/capi/capiutil.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/isdn/capi/capiutil.c b/drivers/isdn/capi/capiutil.c
index 4073d1684d07..b501d76209f0 100644
--- a/drivers/isdn/capi/capiutil.c
+++ b/drivers/isdn/capi/capiutil.c
@@ -207,6 +207,8 @@ static unsigned command_2_index(unsigned c, unsigned sc)
c = 0x9 + (c & 0x0f);
else if (c == 0x41)
c = 0x9 + 0x1;
+ if (c > 0x18)
+ c = 0x00;
return (sc & 3) * (0x9 + 0x9) + c;
}