NetLabel: correct CIPSO tag handling when adding new DOI definitions
authorPaul Moore <paul.moore@hp.com>
Fri, 5 Jan 2007 20:08:22 +0000 (15:08 -0500)
committerDavid S. Miller <davem@sunset.davemloft.net>
Tue, 9 Jan 2007 08:30:01 +0000 (00:30 -0800)
The current netlbl_cipsov4_add_common() function has two problems which are
fixed with this patch.  The first is an off-by-one bug where it is possibile to
overflow the doi_def->tags[] array.  The second is a bug where the same
doi_def->tags[] array was not always fully initialized, which caused sporadic
failures.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
net/netlabel/netlabel_cipso_v4.c

index 4afc75f9e377b7bb167749b8a51ec50589182cf9..73e0ff469bff284c765bc80ebcc723af3e81f38e 100644 (file)
@@ -130,12 +130,12 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,
 
        nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
                if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
-                       if (iter > CIPSO_V4_TAG_MAXCNT)
+                       if (iter >= CIPSO_V4_TAG_MAXCNT)
                                return -EINVAL;
                        doi_def->tags[iter++] = nla_get_u8(nla);
                }
-       if (iter < CIPSO_V4_TAG_MAXCNT)
-               doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
+       while (iter < CIPSO_V4_TAG_MAXCNT)
+               doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
 
        return 0;
 }