Dan Carpenter
96a8d14e87
staging: cxt1e1: buffer overflow in do_del_chan()
...
If we don't restrict "cp.channum" to 3 digits then the sprintf() will
overflow. I've added a check and changed the sprintf() to snprintf().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-01-25 11:21:26 -08:00
..
2011-11-26 18:11:35 -08:00
2011-11-26 18:11:35 -08:00
2010-12-10 10:46:30 -08:00
2011-11-26 18:11:35 -08:00
2010-12-10 10:46:30 -08:00
2011-02-18 13:30:10 -08:00
2011-09-27 18:08:04 +02:00
2012-01-09 12:18:17 -08:00
2013-01-25 11:21:26 -08:00
2010-10-08 07:23:50 -07:00
2012-11-21 14:21:47 -08:00
2012-11-21 14:20:39 -08:00
2011-11-26 18:11:35 -08:00
2010-06-18 15:16:21 -07:00
2011-11-26 18:11:35 -08:00
2011-11-26 18:11:35 -08:00
2011-11-26 18:11:35 -08:00
2011-11-26 18:11:35 -08:00
2011-11-26 18:11:35 -08:00
2010-05-11 14:15:34 -07:00
2011-11-26 18:11:35 -08:00
2011-11-26 18:11:35 -08:00
2011-11-26 18:11:35 -08:00
2011-11-26 18:11:35 -08:00
2012-11-21 14:21:48 -08:00
2011-03-31 11:26:23 -03:00
2011-11-26 18:11:35 -08:00
2011-11-26 18:11:35 -08:00