* [patch] sctp: check len in sctp_getsockopt_assoc_stats()
@ 2013-02-27 20:41 Dan Carpenter
2013-02-27 20:45 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2013-02-27 20:41 UTC (permalink / raw)
To: Vlad Yasevich, Michele Baldessari
Cc: Sridhar Samudrala, Neil Horman, David S. Miller, linux-sctp,
netdev, kernel-janitors
This check is missing an upper bound.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This should go in 3.8 -stable as well.
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c99458d..fbd8386 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5652,6 +5652,8 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
/* User must provide at least the assoc id */
if (len < sizeof(sctp_assoc_t))
return -EINVAL;
+ if (len > sizeof(struct sctp_assoc_stats))
+ len = sizeof(struct sctp_assoc_stats);
if (copy_from_user(&sas, optval, len))
return -EFAULT;
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-02-27 20:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-02-27 20:41 [patch] sctp: check len in sctp_getsockopt_assoc_stats() Dan Carpenter
2013-02-27 20:45 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox