Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2a2f11c2 authored by Paul Moore's avatar Paul Moore Committed by David S. Miller
Browse files

NetLabel: correct CIPSO tag handling when adding new DOI definitions 



The current netlbl_cipsov4_add_common() function has two problems which are
fixed with this patch.  The first is an off-by-one bug where it is possibile to
overflow the doi_def->tags[] array.  The second is a bug where the same
doi_def->tags[] array was not always fully initialized, which caused sporadic
failures.

Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 79795120

net/netlabel/netlabel_cipso_v4.c

+3 −3
Original line number Diff line number Diff line
@@ -130,12 +130,12 @@ static int netlbl_cipsov4_add_common(struct genl_info *info, 


	nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)

		if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {

			if (iter > CIPSO_V4_TAG_MAXCNT)

			if (iter >= CIPSO_V4_TAG_MAXCNT)

				return -EINVAL;

			doi_def->tags[iter++] = nla_get_u8(nla);

		}

	if (iter < CIPSO_V4_TAG_MAXCNT)

		doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;

	while (iter < CIPSO_V4_TAG_MAXCNT)

		doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;



	return 0;

}