| commit | 80aa4e10963cc7d9b5dd5b2568ce28d74af20bf9 | [log] [tgz] |
|---|---|---|
| author | Dan Carpenter <dan.carpenter@oracle.com> | Tue Sep 03 12:03:40 2013 +0300 |
| committer | David S. Miller <davem@davemloft.net> | Wed Sep 04 00:27:27 2013 -0400 |
| tree | 5c864aa3c95f575287ea2f37da2e0589f85a1c1c | |
| parent | cab6ce9ebe89303bbf5eff442776188070a22771 [diff] |
x25: add a sanity check parsing X.25 facilities This was found with a manual audit and I don't have a reproducer. We limit ->calling_len and ->called_len when we get them from copy_from_user() in x25_ioctl() so when they come from skb->data then we should cap them there as well. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>