isdn: fix information leak

The main motivation of this patch changing strcpy() to strlcpy().
We strcpy() to copy a 48 byte buffers into a 49 byte buffers.  So at
best the last byte has leaked information, or maybe there is an
overflow?  Anyway, this patch closes the information leaks by zeroing
the memory and the calls to strlcpy() prevent overflows.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c
index 43c5dc3516e5ac9c1d58844b38f4c776ad8ee90f..4cfdbe08ffd1b91a1dbab0c4a46f0a29f7fb37bb 100644 (file)
--- a/drivers/isdn/sc/ioctl.c
+++ b/drivers/isdn/sc/ioctl.c
@@ -174,7 +174,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                pr_debug("%s: SCIOGETSPID: ioctl received\n",
                                sc_adapter[card]->devicename);
 
-               spid = kmalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
+               spid = kzalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
                if (!spid) {
                        kfree(rcvmsg);
                        return -ENOMEM;
@@ -194,7 +194,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                        kfree(rcvmsg);
                        return status;
                }
-               strcpy(spid, rcvmsg->msg_data.byte_array);
+               strlcpy(spid, rcvmsg->msg_data.byte_array, SCIOC_SPIDSIZE);
 
                /*
                 * Package the switch type and send to user space
@@ -266,12 +266,12 @@ int sc_ioctl(int card, scs_ioctl *data)
                        return status;
                }
 
-               dn = kmalloc(SCIOC_DNSIZE, GFP_KERNEL);
+               dn = kzalloc(SCIOC_DNSIZE, GFP_KERNEL);
                if (!dn) {
                        kfree(rcvmsg);
                        return -ENOMEM;
                }
-               strcpy(dn, rcvmsg->msg_data.byte_array);
+               strlcpy(dn, rcvmsg->msg_data.byte_array, SCIOC_DNSIZE);
                kfree(rcvmsg);
 
                /*
@@ -337,7 +337,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                pr_debug("%s: SCIOSTAT: ioctl received\n",
                                sc_adapter[card]->devicename);
 
-               bi = kmalloc (sizeof(boardInfo), GFP_KERNEL);
+               bi = kzalloc(sizeof(boardInfo), GFP_KERNEL);
                if (!bi) {
                        kfree(rcvmsg);
                        return -ENOMEM;