Commit 3e8a0a55 authored Aug 13, 2008 by Arnaldo Carvalho de Melo Committed by David S. Miller Aug 13, 2008

dccp: change L/R must have at least one byte in the dccpsf_val field


    
Thanks to Eugene Teo for reporting this problem.
    
Signed-off-by: Eugene Teo <eugenete@kernel.sg>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c1e24df2

net/dccp/proto.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -474,6 +474,11 @@ static int dccp_setsockopt_change(struct sock *sk, int type,

		if (copy_from_user(&opt, optval, sizeof(opt)))
		return -EFAULT;
		/*
		* rfc4340: 6.1. Change Options
		*/
		if (opt.dccpsf_len < 1)
		return -EINVAL;

		val = kmalloc(opt.dccpsf_len, GFP_KERNEL);
		if (!val)