lkml.org 
[lkml]   [2011]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 1/2] ax25: integer overflows in ax25_setsockopt()
Date
ax25_setsockopt() misses several upper-bound checks on the
user-controlled value.


Reported-by: Fan Long <longfancn@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
---
net/ax25/af_ax25.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index e7c69f4..be6a8cf 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -571,7 +571,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;

case AX25_T1:
- if (opt < 1) {
+ if (opt < 1 || opt > 30) {
res = -EINVAL;
break;
}
@@ -580,7 +580,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;

case AX25_T2:
- if (opt < 1) {
+ if (opt < 1 || opt > 20) {
res = -EINVAL;
break;
}
@@ -596,7 +596,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;

case AX25_T3:
- if (opt < 1) {
+ if (opt < 0 || opt > 3600) {
res = -EINVAL;
break;
}
@@ -604,7 +604,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
break;

case AX25_IDLE:
- if (opt < 0) {
+ if (opt < 0 || opt > 65535) {
res = -EINVAL;
break;
}
--
1.7.5.4


\
 
 \ /
  Last update: 2011-11-23 05:31    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site