diff options
| author | Paul Mundt <lethal@linux-sh.org> | 2011-03-31 15:39:47 +0900 |
|---|---|---|
| committer | Paul Mundt <lethal@linux-sh.org> | 2011-03-31 15:39:47 +0900 |
| commit | 7ea5db8efeac8627500e012aa6829ca612c5a700 (patch) | |
| tree | 90e4de22f60b989dcf0f0d7436978c0b463d5827 /net/irda | |
| parent | eee7631fdf8ae63c4f24daf66981ac1a7b55d7fd (diff) | |
| parent | 6aba74f2791287ec407e0f92487a725a25908067 (diff) | |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into sh-latest
Diffstat (limited to 'net/irda')
| -rw-r--r-- | net/irda/iriap.c | 6 | ||||
| -rw-r--r-- | net/irda/irnet/irnet_ppp.c | 3 |
2 files changed, 9 insertions, 0 deletions
diff --git a/net/irda/iriap.c b/net/irda/iriap.c index 5b743bdd89b..36477538cea 100644 --- a/net/irda/iriap.c +++ b/net/irda/iriap.c @@ -656,10 +656,16 @@ static void iriap_getvaluebyclass_indication(struct iriap_cb *self, n = 1; name_len = fp[n++]; + + IRDA_ASSERT(name_len < IAS_MAX_CLASSNAME + 1, return;); + memcpy(name, fp+n, name_len); n+=name_len; name[name_len] = '\0'; attr_len = fp[n++]; + + IRDA_ASSERT(attr_len < IAS_MAX_ATTRIBNAME + 1, return;); + memcpy(attr, fp+n, attr_len); n+=attr_len; attr[attr_len] = '\0'; diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c index 7c567b8aa89..2bb2beb6a37 100644 --- a/net/irda/irnet/irnet_ppp.c +++ b/net/irda/irnet/irnet_ppp.c @@ -105,6 +105,9 @@ irnet_ctrl_write(irnet_socket * ap, while(isspace(start[length - 1])) length--; + DABORT(length < 5 || length > NICKNAME_MAX_LEN + 5, + -EINVAL, CTRL_ERROR, "Invalid nickname.\n"); + /* Copy the name for later reuse */ memcpy(ap->rname, start + 5, length - 5); ap->rname[length - 5] = '\0'; |