diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-09-03 11:03:40 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-09-04 06:27:27 +0200 |
| commit | 80aa4e10963cc7d9b5dd5b2568ce28d74af20bf9 (patch) | |
| tree | 5c864aa3c95f575287ea2f37da2e0589f85a1c1c /net/x25/x25_timer.c | |
| parent | caif: add a sanity check to the tty name (diff) | |
| download | linux-80aa4e10963cc7d9b5dd5b2568ce28d74af20bf9.tar.xz linux-80aa4e10963cc7d9b5dd5b2568ce28d74af20bf9.zip | |
x25: add a sanity check parsing X.25 facilities
This was found with a manual audit and I don't have a reproducer. We
limit ->calling_len and ->called_len when we get them from
copy_from_user() in x25_ioctl() so when they come from skb->data then
we should cap them there as well.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/x25/x25_timer.c')
0 files changed, 0 insertions, 0 deletions