x25: Validate incoming call user data lengths
authorMatthew Daley <mattjd@gmail.com>
Fri, 14 Oct 2011 18:45:03 +0000 (18:45 +0000)
committerDavid S. Miller <davem@davemloft.net>
Mon, 17 Oct 2011 23:31:39 +0000 (19:31 -0400)
commitc7fd0d48bde943e228e9c28ce971a22d6a1744c4
tree16eb8261bb302f21549c8663ddfc052025634aed
parentf36c23bb9f822904dacf83a329518d0a5fde7968
x25: Validate incoming call user data lengths

X.25 call user data is being copied in its entirety from incoming messages
without consideration to the size of the destination buffers, leading to
possible buffer overflows. Validate incoming call user data lengths before
these copies are performed.

It appears this issue was noticed some time ago, however nothing seemed to
come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and
commit 8db09f26f912f7c90c764806e804b558da520d4f.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Andrew Hendry <andrew.hendry@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/x25/af_x25.c
net/x25/x25_in.c