summaryrefslogtreecommitdiffstats
path: root/net/x25/x25_in.c
diff options
context:
space:
mode:
authorMatthew Daley <mattjd@gmail.com>2011-10-14 18:45:03 +0000
committerDavid S. Miller <davem@davemloft.net>2011-10-17 19:31:39 -0400
commitc7fd0d48bde943e228e9c28ce971a22d6a1744c4 (patch)
tree16eb8261bb302f21549c8663ddfc052025634aed /net/x25/x25_in.c
parentf36c23bb9f822904dacf83a329518d0a5fde7968 (diff)
x25: Validate incoming call user data lengths
X.25 call user data is being copied in its entirety from incoming messages without consideration to the size of the destination buffers, leading to possible buffer overflows. Validate incoming call user data lengths before these copies are performed. It appears this issue was noticed some time ago, however nothing seemed to come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and commit 8db09f26f912f7c90c764806e804b558da520d4f. Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Andrew Hendry <andrew.hendry@gmail.com> Cc: stable <stable@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/x25/x25_in.c')
-rw-r--r--net/x25/x25_in.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 0b073b51b18..63488fd4885 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -127,6 +127,9 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
* Copy any Call User Data.
*/
if (skb->len > 0) {
+ if (skb->len > X25_MAX_CUD_LEN)
+ goto out_clear;
+
skb_copy_from_linear_data(skb,
x25->calluserdata.cuddata,
skb->len);