patch-2.1.77 linux/drivers/isdn/isdn_tty.c

• Lines: 39
• Date: Mon Dec 29 10:22:42 1997
• Orig file: v2.1.76/linux/drivers/isdn/isdn_tty.c
• Orig date: Wed Sep 24 20:05:47 1997

diff -u --recursive --new-file v2.1.76/linux/drivers/isdn/isdn_tty.c linux/drivers/isdn/isdn_tty.c
@@ -2445,14 +2445,18 @@
  * Get phone-number from modem-commandbuffer
  */
 static void
-isdn_tty_getdial(char *p, char *q)
+isdn_tty_getdial(char *p, char *q,int cnt)
 {
 	int first = 1;
+	int limit=39;	/* MUST match the size in isdn_tty_parse to avoid
+				buffer overflow */
 
-	while (strchr("0123456789,#.*WPTS-", *p) && *p) {
+	while (strchr("0123456789,#.*WPTS-", *p) && *p && --cnt>0) {
 		if ((*p >= '0' && *p <= '9') || ((*p == 'S') && first))
 			*q++ = *p;
 		p++;
+		if(!--limit)
+			break;
 		first = 0;
 	}
 	*q = 0;
@@ -2589,7 +2593,7 @@
 					m->mdmreg[i], ((i + 1) % 10) ? " " : "\r\n");
 				isdn_tty_at_cout(rb, info);
 			}
-			sprintf(rb, "\r\nEAZ/MSN: %s\r\n",
+			sprintf(rb, "\r\nEAZ/MSN: %.50s\r\n",
 				strlen(m->msn) ? m->msn : "None");
 			isdn_tty_at_cout(rb, info);
 			break;
@@ -3092,7 +3096,7 @@
 				break;
 			case 'D':
 				/* D - Dial */
-				isdn_tty_getdial(++p, ds);
+				isdn_tty_getdial(++p, ds, sizeof ds);
 				p += strlen(p);
 				if (!strlen(m->msn))
 					isdn_tty_modem_result(10, info);