| commit | 39ebc0276bada8bb70e067cb6d0eb71839c0fb08 | [log] [tgz] |
|---|---|---|
| author | Arnaldo Carvalho de Melo <acme@ghostprotocols.net> | Wed Mar 28 11:54:32 2007 -0700 |
| committer | David S. Miller <davem@davemloft.net> | Wed Mar 28 11:54:32 2007 -0700 |
| tree | a6afca93101b9142523d6814db12ec09d73e58ef | |
| parent | 53aadcc90931dfa150f76ce9a5f9e8f3e43d57df [diff] |
[DCCP] getsockopt: Fix DCCP_SOCKOPT_[SEND,RECV]_CSCOV We were only checking if there was enough space to put the int, but left len as specified by the (malicious) user, sigh, fix it by setting len to sizeof(val) and transfering just one int worth of data, the one asked for. Also check for negative len values. Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> Signed-off-by: David S. Miller <davem@davemloft.net>