Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9791011 authored by Thomas Graf's avatar Thomas Graf Committed by David S. Miller
Browse files

[DECNet] fib: Fix out of bound access of dn_fib_props[] 



Fixes a typo which caused fib_props[] to have the wrong size
and makes sure the value used to index the array which is
provided by userspace via netlink is checked to avoid out of
bound access.

Signed-off-by: default avatarThomas Graf <tgraf@suug.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a0ee18b9

net/decnet/dn_fib.c

+4 −1
Original line number Diff line number Diff line
@@ -63,7 +63,7 @@ static struct 
{

	int error;

	u8 scope;

} dn_fib_props[RTA_MAX+1] = {

} dn_fib_props[RTN_MAX+1] = {

	[RTN_UNSPEC] =      { .error = 0,       .scope = RT_SCOPE_NOWHERE },

	[RTN_UNICAST] =     { .error = 0,       .scope = RT_SCOPE_UNIVERSE },

	[RTN_LOCAL] =       { .error = 0,       .scope = RT_SCOPE_HOST },
@@ -276,6 +276,9 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct dn_kern_rta 
	struct dn_fib_info *ofi;

	int nhs = 1;



	if (r->rtm_type > RTN_MAX)

		goto err_inval;



	if (dn_fib_props[r->rtm_type].scope > r->rtm_scope)

		goto err_inval;