Patchwork [net-next,3/5] sctp: fix the length check in sctp_getsockopt_maxburst()

login
register
mail settings
Submitter Vlad Yasevich
Date March 2, 2009, 7:46 p.m.
Message ID <1236023174-18314-4-git-send-email-vladislav.yasevich@hp.com>
Download mbox | patch
Permalink /patch/23967/
State Accepted
Delegated to: David Miller
Headers show

Comments

Vlad Yasevich - March 2, 2009, 7:46 p.m.
From: Wei Yongjun <yjwei@cn.fujitsu.com>

The code in sctp_getsockopt_maxburst() doesn't allow len to be larger
then struct sctp_assoc_value, which is a common case where app writers
just pass down the sizeof(buf) or something similar.

This patch fix the problem.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
---
 net/sctp/socket.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

Patch

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 4bc558c..bbd3cd2 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5286,7 +5286,8 @@  static int sctp_getsockopt_maxburst(struct sock *sk, int len,
 		printk(KERN_WARNING
 		   "SCTP: Use struct sctp_assoc_value instead\n");
 		params.assoc_id = 0;
-	} else if (len == sizeof (struct sctp_assoc_value)) {
+	} else if (len >= sizeof(struct sctp_assoc_value)) {
+		len = sizeof(struct sctp_assoc_value);
 		if (copy_from_user(&params, optval, len))
 			return -EFAULT;
 	} else