[PATCH 2/2] ax25: integer overflows in ax25_ctl_ioctl()
From: Xi Wang <xi.wang@gmail.com>
Date: 2011-11-23 04:35:20
Also in:
linux-hams, lkml
Subsystem:
networking [general], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
ax25_ctl_ioctl() misses several bound checks on the user-controlled value. Signed-off-by: Xi Wang <xi.wang@gmail.com> --- net/ax25/af_ax25.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index be6a8cf..bd47e22 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c@@ -402,14 +402,14 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) break; case AX25_T1: - if (ax25_ctl.arg < 1) + if (ax25_ctl.arg < 1 || ax25_ctl.arg > 30) goto einval_put; ax25->rtt = (ax25_ctl.arg * HZ) / 2; ax25->t1 = ax25_ctl.arg * HZ; break; case AX25_T2: - if (ax25_ctl.arg < 1) + if (ax25_ctl.arg < 1 || ax25_ctl.arg > 20) goto einval_put; ax25->t2 = ax25_ctl.arg * HZ; break;
@@ -422,10 +422,14 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) break; case AX25_T3: + if (ax25_ctl.arg > 3600) + goto einval_put; ax25->t3 = ax25_ctl.arg * HZ; break; case AX25_IDLE: + if (ax25_ctl.arg > 65535) + goto einval_put; ax25->idle = ax25_ctl.arg * 60 * HZ; break;
--
1.7.5.4