lkml.org 
[lkml]   [2011]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/2] ax25: integer overflows in ax25_setsockopt()
    Date
    ax25_setsockopt() misses several upper-bound checks on the
    user-controlled value.


    Reported-by: Fan Long <longfancn@gmail.com>
    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    ---
    net/ax25/af_ax25.c | 8 ++++----
    1 files changed, 4 insertions(+), 4 deletions(-)

    diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
    index e7c69f4..be6a8cf 100644
    --- a/net/ax25/af_ax25.c
    +++ b/net/ax25/af_ax25.c
    @@ -571,7 +571,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    break;

    case AX25_T1:
    - if (opt < 1) {
    + if (opt < 1 || opt > 30) {
    res = -EINVAL;
    break;
    }
    @@ -580,7 +580,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    break;

    case AX25_T2:
    - if (opt < 1) {
    + if (opt < 1 || opt > 20) {
    res = -EINVAL;
    break;
    }
    @@ -596,7 +596,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    break;

    case AX25_T3:
    - if (opt < 1) {
    + if (opt < 0 || opt > 3600) {
    res = -EINVAL;
    break;
    }
    @@ -604,7 +604,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    break;

    case AX25_IDLE:
    - if (opt < 0) {
    + if (opt < 0 || opt > 65535) {
    res = -EINVAL;
    break;
    }
    --
    1.7.5.4


    \
     
     \ /
      Last update: 2011-11-23 05:31    [W:0.019 / U:32.500 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site