diff options
| author | Paul Stewart <pstew@google.com> | 2017-02-02 12:02:47 -0800 |
|---|---|---|
| committer | Feng Yu <feny@google.com> | 2017-02-15 01:50:00 +0000 |
| commit | 10376eddc2177523a8ffc3bc9bb0aa2e9525b10f (patch) | |
| tree | d2c82636a75931284584c0ccb77b6284f096d3c1 | |
| parent | 54d08c63f9631d0a65f2be136993a76cd49881c9 (diff) | |
| download | platform_external_libnl-nougat-mr1-security-release.tar.gz platform_external_libnl-nougat-mr1-security-release.tar.bz2 platform_external_libnl-nougat-mr1-security-release.zip | |
Perform range check on len in nlmsg_reserveandroid-7.1.1_r61android-7.1.1_r60android-7.1.1_r59nougat-mr1.8-releasenougat-mr1-security-release
Bug: 32342065
Test: Compile
Change-Id: I2ef3d63f0910120721c1448eb7d4d64bcec71009
(cherry picked from commit 438fe14af8e839a9186ba30cddbe81ad2311ed00)
| -rw-r--r-- | lib/msg.c | 3 |
1 files changed, 3 insertions, 0 deletions
@@ -518,6 +518,9 @@ void *nlmsg_reserve(struct nl_msg *n, size_t len, int pad) size_t nlmsg_len = n->nm_nlh->nlmsg_len; size_t tlen; + if (len > n->nm_size) + return NULL; + tlen = pad ? ((len + (pad - 1)) & ~(pad - 1)) : len; if ((tlen + nlmsg_len) > n->nm_size) |