Thread (3 messages) 3 messages, 3 authors, 2020-07-24

Re: [Linux-kernel-mentees] [PATCH net] AX.25: Prevent out-of-bounds read in ax25_sendmsg()

From: David Miller <davem@davemloft.net>
Date: 2020-07-23 01:07:26
Also in: linux-hams, linux-kernel-mentees, lkml

From: Peilin Ye <redacted>
Date: Wed, 22 Jul 2020 12:05:12 -0400
Checks on `addr_len` and `usax->sax25_ndigis` are insufficient.
ax25_sendmsg() can go out of bounds when `usax->sax25_ndigis` equals to 7
or 8. Fix it.

It is safe to remove `usax->sax25_ndigis > AX25_MAX_DIGIS`, since
`addr_len` is guaranteed to be less than or equal to
`sizeof(struct full_sockaddr_ax25)`

Signed-off-by: Peilin Ye <redacted>
Applied.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help