diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-09-03 12:03:40 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-09-04 00:27:27 -0400 |
| commit | 80aa4e10963cc7d9b5dd5b2568ce28d74af20bf9 (patch) | |
| tree | 5c864aa3c95f575287ea2f37da2e0589f85a1c1c /lib/ts_kmp.c | |
| parent | cab6ce9ebe89303bbf5eff442776188070a22771 (diff) | |
x25: add a sanity check parsing X.25 facilities
This was found with a manual audit and I don't have a reproducer. We
limit ->calling_len and ->called_len when we get them from
copy_from_user() in x25_ioctl() so when they come from skb->data then
we should cap them there as well.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'lib/ts_kmp.c')
0 files changed, 0 insertions, 0 deletions