diff options
| author | Alan Cox <alan@lxorguk.ukuu.org.uk> | 2009-03-27 00:28:21 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-03-27 00:28:21 -0700 |
| commit | 83e0bbcbe2145f160fbaa109b0439dae7f4a38a9 (patch) | |
| tree | de3f516afc1878914855c9393b1e08c698ac378c /net/x25/af_x25.c | |
| parent | 03ba999117eb8688252f9068356b6e028c2c3a56 (diff) | |
| download | op-kernel-dev-83e0bbcbe2145f160fbaa109b0439dae7f4a38a9.zip op-kernel-dev-83e0bbcbe2145f160fbaa109b0439dae7f4a38a9.tar.gz | |
af_rose/x25: Sanity check the maximum user frame size
Otherwise we can wrap the sizes and end up sending garbage.
Closes #10423
Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/x25/af_x25.c')
| -rw-r--r-- | net/x25/af_x25.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c index 9ca17b1..ed80af8 100644 --- a/net/x25/af_x25.c +++ b/net/x25/af_x25.c @@ -1035,6 +1035,12 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock, sx25.sx25_addr = x25->dest_addr; } + /* Sanity check the packet size */ + if (len > 65535) { + rc = -EMSGSIZE; + goto out; + } + SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n"); /* Build a packet */ |
