Dan Carpenter c101cff901 isdn: off by one in connect_res() ... The bug here is that we use "Reject" as the index into the cau_t[] array in the else path. Since the cau_t[] has 9 elements if Reject == 9 then we are reading beyond the end of the array. My understanding of the code is that it's saying that if Reject is 1 or too high then that's invalid and we should hang up. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-02-02 19:33:18 -08:00
..
act2000	isdn: replace del_timer by del_timer_sync	2014-03-27 15:28:06 -04:00
capi	isdn/capi: correct argument types of command_2_index	2014-12-10 15:06:10 -05:00
divert	isdn: divert, hysdn: fix interruptible_sleep_on race	2014-02-26 16:06:13 -05:00
gigaset	isdn/gigaset: enable Kernel CAPI support by default	2014-12-10 15:06:10 -05:00
hardware	isdn: off by one in connect_res()	2015-02-02 19:33:18 -08:00
hisax	isdn: fix misspelling of current function in string	2014-12-09 16:18:46 -05:00
hysdn	isdn: fix misspelling of current function in string	2014-12-09 16:18:46 -05:00
i4l	isdn: i4l: Remove ASYNC_CTS_FLOW	2014-09-23 21:19:35 -07:00
icn	isdn: icn: buffer overflow in icn_command()	2014-04-16 15:24:15 -04:00
isdnloop	isdnloop: several buffer overflows	2014-04-08 12:41:13 -04:00
mISDN	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2014-12-12 10:08:06 -08:00
pcbit	isdn: fix misspelling of current function in string	2014-12-09 16:18:46 -05:00
sc	isdn: replace del_timer by del_timer_sync	2014-03-27 15:28:06 -04:00
Kconfig
Makefile