The patch titled
Overrun in isdn_tty.c
has been removed from the -mm tree. Its filename is
overrun-in-isdn_ttyc.patch
This patch was probably dropped from -mm because
it has now been merged into a subsystem tree or
into Linus's tree, or because it was folded into
its parent patch in the -mm tree.
------------------------------------------------------
Subject: Overrun in isdn_tty.c
From: Eric Sesterhenn <snakebyte@xxxxxx>
This fixes coverity bug id #1237. After the while loop, it is possible for
i == ISDN_LMSNLEN. If this happens the terminating '\0' is written after
the end of the array.
Signed-off-by: Eric Sesterhenn <snakebyte@xxxxxx>
Cc: Karsten Keil <kkeil@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/isdn/i4l/isdn_tty.c | 2 +-
1 files changed, 1 insertion(+), 1 deletion(-)
diff -puN drivers/isdn/i4l/isdn_tty.c~overrun-in-isdn_ttyc drivers/isdn/i4l/isdn_tty.c
--- devel/drivers/isdn/i4l/isdn_tty.c~overrun-in-isdn_ttyc 2006-05-20 14:59:36.000000000 -0700
+++ devel-akpm/drivers/isdn/i4l/isdn_tty.c 2006-05-20 14:59:36.000000000 -0700
@@ -2880,7 +2880,7 @@ isdn_tty_cmd_ATand(char **p, modem_info
p[0]++;
i = 0;
while (*p[0] && (strchr("0123456789,-*[]?;", *p[0])) &&
- (i < ISDN_LMSNLEN))
+ (i < ISDN_LMSNLEN - 1))
m->lmsn[i++] = *p[0]++;
m->lmsn[i] = '\0';
break;
_
Patches currently in -mm which might be from snakebyte@xxxxxx are
origin.patch
git-alsa.patch
git-dvb.patch
git-gfs2.patch
more-bug_on-conversion.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
