[PATCH 1/2] ax25: integer overflows in ax25_setsockopt()
From: Xi Wang <xi.wang@gmail.com>
Date: 2011-11-23 04:28:30
Also in:
linux-hams, lkml
Subsystem:
networking [general], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
ax25_setsockopt() misses several upper-bound checks on the user-controlled value. Reported-by: Fan Long <redacted> Signed-off-by: Xi Wang <xi.wang@gmail.com> --- net/ax25/af_ax25.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index e7c69f4..be6a8cf 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c@@ -571,7 +571,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_T1: - if (opt < 1) { + if (opt < 1 || opt > 30) { res = -EINVAL; break; }
@@ -580,7 +580,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_T2: - if (opt < 1) { + if (opt < 1 || opt > 20) { res = -EINVAL; break; }
@@ -596,7 +596,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_T3: - if (opt < 1) { + if (opt < 0 || opt > 3600) { res = -EINVAL; break; }
@@ -604,7 +604,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, break; case AX25_IDLE: - if (opt < 0) { + if (opt < 0 || opt > 65535) { res = -EINVAL; break; }
--
1.7.5.4