Thread (6 messages) flat view 6 messages, 4 authors, 2014-07-17

Re: [patch v2] wan/x25_asy: integer overflow in x25_asy_change_mtu()

From: David Miller <davem@davemloft.net>
Date: 2014-07-17 23:48:53
Also in: kernel-janitors

From: Dan Carpenter <redacted>
Date: Thu, 17 Jul 2014 13:50:45 +0300
If "newmtu * 2 + 4" is too large then it can cause an integer overflow
leading to memory corruption.  Eric Dumazet suggests that 65534 is a
reasonable upper limit.

Btw, "newmtu" is not allowed to be a negative number because of the
check in dev_set_mtu(), so that's ok.

Signed-off-by: Dan Carpenter <redacted>
---
v2: Cap it at 65534 instead of just testing for integer overflows.
    Thanks David and Eric!
Applied.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help