diff options
| author | David Stevens <dlstevens@us.ibm.com> | 2004-02-24 08:24:37 -0800 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2004-02-24 08:24:37 -0800 |
| commit | 5c4cee5b0ac4205a896261f5a4607031010c7dbb (patch) | |
| tree | e8fb5483665a9fc24299f1188692da15a4833485 | |
| parent | d894b9155acb7bc04f7b6265f83a89f5bbf4a86c (diff) | |
[IGMP/MLD]: Check for numsrc overflow, plus temp buffer tweaks.
| -rw-r--r-- | net/ipv4/ip_sockglue.c | 9 | ||||
| -rw-r--r-- | net/ipv6/ipv6_sockglue.c | 8 |
2 files changed, 15 insertions, 2 deletions
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index ec46daa8caba..d8f9eafe590f 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -617,10 +617,15 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char *optval, int opt } case IP_MSFILTER: { + extern int sysctl_optmem_max; struct ip_msfilter *msf; if (optlen < IP_MSFILTER_SIZE(0)) goto e_inval; + if (optlen > sysctl_optmem_max) { + err = -ENOBUFS; + break; + } msf = (struct ip_msfilter *)kmalloc(optlen, GFP_KERNEL); if (msf == 0) { err = -ENOBUFS; @@ -631,7 +636,9 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char *optval, int opt kfree(msf); break; } - if (IP_MSFILTER_SIZE(msf->imsf_numsrc) > optlen) { + if (IP_MSFILTER_SIZE(msf->imsf_numsrc) < + IP_MSFILTER_SIZE(0) || + IP_MSFILTER_SIZE(msf->imsf_numsrc) > optlen) { kfree(msf); err = -EINVAL; break; diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 320c185f8cf5..1b28ffcefc4e 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -436,10 +436,15 @@ done: } case MCAST_MSFILTER: { + extern int sysctl_optmem_max; struct group_filter *gsf; if (optlen < GROUP_FILTER_SIZE(0)) goto e_inval; + if (optlen > sysctl_optmem_max) { + retv = -ENOBUFS; + break; + } gsf = (struct group_filter *)kmalloc(optlen,GFP_KERNEL); if (gsf == 0) { retv = -ENOBUFS; @@ -450,7 +455,8 @@ done: kfree(gsf); break; } - if (GROUP_FILTER_SIZE(gsf->gf_numsrc) > optlen) { + if (GROUP_FILTER_SIZE(gsf->gf_numsrc) < GROUP_FILTER_SIZE(0) || + GROUP_FILTER_SIZE(gsf->gf_numsrc) > optlen) { kfree(gsf); retv = -EINVAL; break; |