Searched hist:"8 db09f26f912f7c90c764806e804b558da520d4f" (Results 1 – 2 of 2) sorted by relevance
| /openbmc/linux/net/x25/ |
| H A D | x25_in.c | diff c7fd0d48bde943e228e9c28ce971a22d6a1744c4 Fri Oct 14 13:45:03 CDT 2011 Matthew Daley <mattjd@gmail.com> x25: Validate incoming call user data lengths
X.25 call user data is being copied in its entirety from incoming messages
without consideration to the size of the destination buffers, leading to
possible buffer overflows. Validate incoming call user data lengths before
these copies are performed.
It appears this issue was noticed some time ago, however nothing seemed to
come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and
commit 8db09f26f912f7c90c764806e804b558da520d4f.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Andrew Hendry <andrew.hendry@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
| H A D | af_x25.c | diff c7fd0d48bde943e228e9c28ce971a22d6a1744c4 Fri Oct 14 13:45:03 CDT 2011 Matthew Daley <mattjd@gmail.com> x25: Validate incoming call user data lengths
X.25 call user data is being copied in its entirety from incoming messages
without consideration to the size of the destination buffers, leading to
possible buffer overflows. Validate incoming call user data lengths before
these copies are performed.
It appears this issue was noticed some time ago, however nothing seemed to
come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and
commit 8db09f26f912f7c90c764806e804b558da520d4f.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Andrew Hendry <andrew.hendry@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
diff 8db09f26f912f7c90c764806e804b558da520d4f Fri Mar 13 18:04:12 CDT 2009 Roel Kluin <roel.kluin@gmail.com> x25: '< 0' and '>= 0' test on unsigned
skb->len is an unsigned int, so the test in x25_rx_call_request() always
evaluates to true.
len in x25_sendmsg() is unsigned as well. so -ERRORS returned by x25_output()
are not noticed.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
|