diff options
| author | David S. Miller <davem@davemloft.net> | 2008-09-16 14:11:43 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-09-16 14:11:43 -0700 |
| commit | 2e57572a50a4de41c6cbc879a4866a312d4cd316 (patch) | |
| tree | c4f58ec96c06642c4b415b881d3f0a3b673d5b44 /net/sctp/socket.c | |
| parent | 9b2e43ae4e9609f80034dfe8de895045cac52d77 (diff) | |
| parent | f948cc6ab9e61a8e88d70ee9aafc690e6d26f92c (diff) | |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6
Conflicts:
arch/sparc64/kernel/pci_psycho.c
Diffstat (limited to 'net/sctp/socket.c')
| -rw-r--r-- | net/sctp/socket.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index bb5c9ef13046..5ffb9dec1c3f 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -3086,6 +3086,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, int optlen) { struct sctp_hmacalgo *hmacs; + u32 idents; int err; if (!sctp_auth_enable) @@ -3103,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, goto out; } - if (hmacs->shmac_num_idents == 0 || - hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) { + idents = hmacs->shmac_num_idents; + if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS || + (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) { err = -EINVAL; goto out; } @@ -3144,6 +3146,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk, goto out; } + if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) { + ret = -EINVAL; + goto out; + } + asoc = sctp_id2assoc(sk, authkey->sca_assoc_id); if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) { ret = -EINVAL; |