linux-kernel - Re: [PATCH] isdn/i4l: Fix DLE handling for i4l-audio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 4 Jan 2008 11:42:28 +0100
From:	Matthias Goebl <matthias@...bl.net>
To:	David Miller <davem@...emloft.net>
Cc:	linux-kernel@...r.kernel.org, kkeil@...e.de,
	kai.germaschewski@....de
Subject: Re: [PATCH] isdn/i4l: Fix DLE handling for i4l-audio

On Fri, Jan 04, 2008 at 02:14:37AM -0800, David Miller wrote:
> From: Matthias Goebl <matthias@...bl.net>
> Date: Thu, 3 Jan 2008 23:00:03 +0100
> 
> > --- linux-2.6.23.12.orig/drivers/isdn/i4l/isdn_tty.c	2007-12-22 21:13:49.000000000 +0100
> > +++ linux-2.6.23.12/drivers/isdn/i4l/isdn_tty.c	2007-12-26 11:37:18.000000000 +0100
> > @@ -85,6 +85,8 @@
> >  								tty_insert_flip_char(tty, DLE, 0);
> >  							tty_insert_flip_char(tty, *dp++, 0);
> >  						}
> > +						if (*dp == DLE)
> > +							tty_insert_flip_char(tty, DLE, 0);
> >  						last = *dp;
> >  					} else {
> >  #endif
> 
> I'm not sure this part is correct.
> 
> Here, *dp will be assigned to 'last'.

The while (--l) {...} pushes+adds DLE for len-1 characters.
( while (l--) would process all len characters)
The last charater is assigned to "last" and pushed after the else block:

> The rest of the code (after the else block) then reads:
> 
> 					if (info->emu.mdmreg[REG_CPPP] & BIT_CPPP)
> 						tty_insert_flip_char(tty, last, 0xFF);
> 					else
> 						tty_insert_flip_char(tty, last, TTY_NORMAL);
> 
> which should push that character out to the TTY.

But this does not care about a DLE and doesn't escape that with another DLE.

> With your change we will push a DLE out twice in such a case,
> and that doesn't seem right.

For an audio data stream we have to escape DLE (ascii 16) by another DLE,
otherwise it is interpreted as command, as in Documentation/isdn/README.audio:
...  escape sequences defined, all using DLE (0x10) as Escape char:...
    <DLE><DLE>              Escape sequence for DLE in data stream.
    <DLE>0                  Touchtone "0" received.
...
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/