Commit 47076e68 authored by Kai Germaschewski's avatar Kai Germaschewski

ISDN: cleanups / overflow check

Based on work done by Solar Designer for 2.2
parent 067a4195
...@@ -706,7 +706,7 @@ isdn_ppp_fill_rq(unsigned char *buf, int len, int proto, int slot) ...@@ -706,7 +706,7 @@ isdn_ppp_fill_rq(unsigned char *buf, int len, int proto, int slot)
* reports, that there is data * reports, that there is data
*/ */
static int static ssize_t
isdn_ppp_read(struct file *file, char *buf, size_t count, loff_t *off) isdn_ppp_read(struct file *file, char *buf, size_t count, loff_t *off)
{ {
struct ippp_struct *is; struct ippp_struct *is;
...@@ -765,7 +765,7 @@ isdn_ppp_read(struct file *file, char *buf, size_t count, loff_t *off) ...@@ -765,7 +765,7 @@ isdn_ppp_read(struct file *file, char *buf, size_t count, loff_t *off)
* ipppd wanna write a packet to the card .. non-blocking * ipppd wanna write a packet to the card .. non-blocking
*/ */
static int static ssize_t
isdn_ppp_write(struct file *file, const char *buf, size_t count, loff_t *off) isdn_ppp_write(struct file *file, const char *buf, size_t count, loff_t *off)
{ {
isdn_net_local *lp; isdn_net_local *lp;
......
...@@ -430,7 +430,7 @@ int pcbit_writecmd(const u_char* buf, int len, int user, int driver, int channel ...@@ -430,7 +430,7 @@ int pcbit_writecmd(const u_char* buf, int len, int user, int driver, int channel
switch(dev->l2_state) { switch(dev->l2_state) {
case L2_LWMODE: case L2_LWMODE:
/* check (size <= rdp_size); write buf into board */ /* check (size <= rdp_size); write buf into board */
if (len > BANK4 + 1) if (len < 0 || len > BANK4 + 1 || len > 1024)
{ {
printk("pcbit_writecmd: invalid length %d\n", len); printk("pcbit_writecmd: invalid length %d\n", len);
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment