Searched hist:"39 ebc027" (Results 1 – 1 of 1) sorted by relevance
| /openbmc/linux/net/dccp/ |
| H A D | proto.c | 39ebc027 Wed Mar 28 13:54:32 CDT 2007 Arnaldo Carvalho de Melo <acme@ghostprotocols.net> [DCCP] getsockopt: Fix DCCP_SOCKOPT_[SEND,RECV]_CSCOV
We were only checking if there was enough space to put the int, but
left len as specified by the (malicious) user, sigh, fix it by setting
len to sizeof(val) and transfering just one int worth of data, the one
asked for.
Also check for negative len values.
Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
39ebc027 Wed Mar 28 13:54:32 CDT 2007 Arnaldo Carvalho de Melo <acme@ghostprotocols.net> [DCCP] getsockopt: Fix DCCP_SOCKOPT_[SEND,RECV]_CSCOV
We were only checking if there was enough space to put the int, but
left len as specified by the (malicious) user, sigh, fix it by setting
len to sizeof(val) and transfering just one int worth of data, the one
asked for.
Also check for negative len values.
Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
|