Dan Carpenter 7bcc6738ee ISDN: pcbit: off by one bugs in pcbit_set_msn() ... 1) We don't allocate enough space for the NUL terminator so we end up corrupting one character beyond the end of the buffer. 2) The "len - 1" should just be "len". The code is trying to copy a word from a buffer up to a comma or the last word in the buffer. Say you have the buffer, "foo,bar,baz", then this code truncates the last letter off each word so you get "fo", "ba", and "ba". You would hope this kind of bug would get noticed in testing... I'm not very familiar with this code and I can't test it, but I think we should copy the final character. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-07-31 22:14:54 -07:00
..
act2000	isdn: replace del_timer by del_timer_sync	2014-03-27 15:28:06 -04:00
capi	CAPI: use correct structure type name in sizeof	2014-07-30 19:13:40 -07:00
divert	isdn: divert, hysdn: fix interruptible_sleep_on race	2014-02-26 16:06:13 -05:00
gigaset	isdn/bas_gigaset: fix a leak on failure path in gigaset_probe()	2014-07-29 12:18:34 -07:00
hardware	isdn: remove deprecated IRQF_DISABLED	2013-10-17 15:13:20 -04:00
hisax	isdn: hisax: l3ni1.c: Fix for possible null pointer dereference	2014-07-08 16:06:21 -07:00
hysdn	isdn: divert, hysdn: fix interruptible_sleep_on race	2014-02-26 16:06:13 -05:00
i4l	isdn: use constants instead of magicnumbers	2014-07-24 23:31:36 -07:00
icn	isdn: icn: buffer overflow in icn_command()	2014-04-16 15:24:15 -04:00
isdnloop	isdnloop: several buffer overflows	2014-04-08 12:41:13 -04:00
mISDN	mISDN: Use mod_timer()	2014-05-22 15:50:12 -04:00
pcbit	ISDN: pcbit: off by one bugs in pcbit_set_msn()	2014-07-31 22:14:54 -07:00
sc	isdn: replace del_timer by del_timer_sync	2014-03-27 15:28:06 -04:00
Kconfig
Makefile