diff options
| author | David S. Miller <davem@davemloft.net> | 2018-02-20 00:46:11 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-02-20 00:46:11 +0100 |
| commit | f5c0c6f4299f870f074235fbf552ecf957fc249c (patch) | |
| tree | 6b46b9c0b271185b6f98fab350c3891042e729b1 /net/nfc | |
| parent | tipc: don't call sock_release() in atomic context (diff) | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (diff) | |
| download | linux-f5c0c6f4299f870f074235fbf552ecf957fc249c.tar.xz linux-f5c0c6f4299f870f074235fbf552ecf957fc249c.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Diffstat (limited to 'net/nfc')
| -rw-r--r-- | net/nfc/llcp_commands.c | 4 | ||||
| -rw-r--r-- | net/nfc/netlink.c | 3 |
2 files changed, 6 insertions, 1 deletions
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c index 367d8c027101..2ceefa183cee 100644 --- a/net/nfc/llcp_commands.c +++ b/net/nfc/llcp_commands.c @@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri, pr_debug("uri: %s, len: %zu\n", uri, uri_len); + /* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */ + if (WARN_ON_ONCE(uri_len > U8_MAX - 4)) + return NULL; + sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL); if (sdreq == NULL) return NULL; diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c index c0b83dc9d993..f018eafc2a0d 100644 --- a/net/nfc/netlink.c +++ b/net/nfc/netlink.c @@ -61,7 +61,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = { }; static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = { - [NFC_SDP_ATTR_URI] = { .type = NLA_STRING }, + [NFC_SDP_ATTR_URI] = { .type = NLA_STRING, + .len = U8_MAX - 4 }, [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 }, }; |