diff --git a/drivers/dahdi/dahdi-base.c b/drivers/dahdi/dahdi-base.c index 87177a69..c78775e0 100644 --- a/drivers/dahdi/dahdi-base.c +++ b/drivers/dahdi/dahdi-base.c @@ -5380,7 +5380,7 @@ static int dahdi_ioctl_get_version(unsigned long data) { struct dahdi_versioninfo vi; struct ecfactory *cur; - size_t space = sizeof(vi.echo_canceller) - 1; + size_t space = sizeof(vi.echo_canceller) - 1, ec_name_len; bool have_hwec = dahdi_any_hwec_available(); memset(&vi, 0, sizeof(vi)); @@ -5404,9 +5404,10 @@ static int dahdi_ioctl_get_version(unsigned long data) } strncat(vi.echo_canceller + strlen(vi.echo_canceller), ec_name, space); - space -= strlen(ec_name); - if (space < 1) + ec_name_len = strlen(ec_name); + if (ec_name_len > space + 1) break; + space -= ec_name_len; if (cur->list.next && (cur->list.next != &ecfactory_list)) { strncat(vi.echo_canceller + strlen(vi.echo_canceller), ", ", space);