diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-09-27 22:21:19 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-10-01 17:15:06 -0400 |
| commit | f674e72ff1aad23a99c7c205473cf02c85c2ac33 (patch) | |
| tree | 032274dd7d42c5feeb17fe8b944ce9709001e339 | |
| parent | 862096a8bbf8f992f6d0a1a8786ffd3fc7437e48 (diff) | |
net/key/af_key.c: add range checks on ->sadb_x_policy_len
Because sizeof() is size_t then if "len" is negative, it counts as a
large positive value.
The call tree looks like:
pfkey_sendmsg()
-> pfkey_process()
-> pfkey_spdadd()
-> parse_ipsecrequests()
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/key/af_key.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/key/af_key.c b/net/key/af_key.c index 2ca7d7f6861c..08897a3c7ec7 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1923,6 +1923,9 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol) int len = pol->sadb_x_policy_len*8 - sizeof(struct sadb_x_policy); struct sadb_x_ipsecrequest *rq = (void*)(pol+1); + if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy)) + return -EINVAL; + while (len >= sizeof(struct sadb_x_ipsecrequest)) { if ((err = parse_ipsecrequest(xp, rq)) < 0) return err; |