aboutsummaryrefslogtreecommitdiffstats
path: root/net/x25
diff options
context:
space:
mode:
authorMatthew Daley <mattjd@gmail.com>2011-10-14 18:45:05 +0000
committerGreg Kroah-Hartman <gregkh@suse.de>2011-10-25 07:10:17 +0200
commit4ea7f3aa5d3fbec2e09edb8c03bc764f9514d3d2 (patch)
treef20dd64cce42007879a319b5db23962c88acb7bb /net/x25
parent6b2f66dc9cabb7eb348587fdac6b3a64545e2d5f (diff)
downloadkernel_samsung_smdk4412-4ea7f3aa5d3fbec2e09edb8c03bc764f9514d3d2.tar.gz
kernel_samsung_smdk4412-4ea7f3aa5d3fbec2e09edb8c03bc764f9514d3d2.tar.bz2
kernel_samsung_smdk4412-4ea7f3aa5d3fbec2e09edb8c03bc764f9514d3d2.zip
x25: Prevent skb overreads when checking call user data
commit 7f81e25befdfb3272345a2e775f520e1d515fa20 upstream. x25_find_listener does not check that the amount of call user data given in the skb is big enough in per-socket comparisons, hence buffer overreads may occur. Fix this by adding a check. Signed-off-by: Matthew Daley <mattjd@gmail.com> Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: Andrew Hendry <andrew.hendry@gmail.com> Acked-by: Andrew Hendry <andrew.hendry@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net/x25')
-rw-r--r--net/x25/af_x25.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 4680b1e4c79..373e14f21a1 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -295,7 +295,8 @@ static struct sock *x25_find_listener(struct x25_address *addr,
* Found a listening socket, now check the incoming
* call user data vs this sockets call user data
*/
- if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
+ if (x25_sk(s)->cudmatchlength > 0 &&
+ skb->len >= x25_sk(s)->cudmatchlength) {
if((memcmp(x25_sk(s)->calluserdata.cuddata,
skb->data,
x25_sk(s)->cudmatchlength)) == 0) {