Messages in this thread Patch in this message | | | Date | Mon, 18 Aug 2008 12:20:05 -0700 | From | Greg KH <> | Subject | [patch 22/49] dccp: change L/R must have at least one byte in the dccpsf_val field |
| |
2.6.25-stable review patch. If anyone has any objections, please let us know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
commit 3e8a0a559c66ee9e7468195691a56fefc3589740 upstream
Thanks to Eugene Teo for reporting this problem.
Signed-off-by: Eugene Teo <eugeneteo@kernel.sg> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- net/dccp/proto.c | 5 +++++ 1 file changed, 5 insertions(+)
--- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@ -477,6 +477,11 @@ static int dccp_setsockopt_change(struct if (copy_from_user(&opt, optval, sizeof(opt))) return -EFAULT; + /* + * rfc4340: 6.1. Change Options + */ + if (opt.dccpsf_len < 1) + return -EINVAL; val = kmalloc(opt.dccpsf_len, GFP_KERNEL); if (!val) --
| |