summaryrefslogtreecommitdiffstats
path: root/net/ipv4/tcp_minisocks.c
diff options
context:
space:
mode:
authorDan Rosenberg <drosenberg@vsecurity.com>2011-05-06 05:27:18 +0200
committerDavid S. Miller <davem@davemloft.net>2011-05-06 22:05:50 +0200
commita294865978b701e4d0d90135672749531b9a900d (patch)
tree4edb7c20db20d81867562fc5cbc0d7c7b5a70df5 /net/ipv4/tcp_minisocks.c
parentcan: fix SJA1000 dlc for RTR packets (diff)
downloadlinux-a294865978b701e4d0d90135672749531b9a900d.tar.xz
linux-a294865978b701e4d0d90135672749531b9a900d.zip
dccp: handle invalid feature options length
A length of zero (after subtracting two for the type and len fields) for the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to the subtraction. The subsequent code may read past the end of the options value buffer when parsing. I'm unsure of what the consequences of this might be, but it's probably not good. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: stable@kernel.org Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_minisocks.c')
0 files changed, 0 insertions, 0 deletions