From: Eric Sesterhenn <snakebyte@gmx.de>

This fixes coverity bug id #1237.  After the while loop, it is possible for
i == ISDN_LMSNLEN.  If this happens the terminating '\0' is written after
the end of the array.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 drivers/isdn/i4l/isdn_tty.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

diff -puN drivers/isdn/i4l/isdn_tty.c~overrun-in-isdn_ttyc drivers/isdn/i4l/isdn_tty.c
--- devel/drivers/isdn/i4l/isdn_tty.c~overrun-in-isdn_ttyc	2006-05-17 22:53:31.000000000 -0700
+++ devel-akpm/drivers/isdn/i4l/isdn_tty.c	2006-05-17 22:53:31.000000000 -0700
@@ -2880,7 +2880,7 @@ isdn_tty_cmd_ATand(char **p, modem_info 
 			p[0]++;
 			i = 0;
 			while (*p[0] && (strchr("0123456789,-*[]?;", *p[0])) &&
-			       (i < ISDN_LMSNLEN))
+			       (i < ISDN_LMSNLEN - 1))
 				m->lmsn[i++] = *p[0]++;
 			m->lmsn[i] = '\0';
 			break;
_