Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a28398ba authored by Wang Chen's avatar Wang Chen Committed by YOSHIFUJI Hideaki
Browse files

[IPV6]: Check length of optval provided by user in setsockopt(). 



Check length of setsockopt's optval, which provided by user, before copy it
from user space.
For POSIX compliant, return -EINVAL for setsockopt of short lengths.

Signed-off-by: default avatarWang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
parent 7f1eced8

net/ipv6/ipv6_sockglue.c

+8 −2
Original line number Diff line number Diff line
@@ -449,6 +449,9 @@ done: 
	{

		struct ipv6_mreq mreq;



		if (optlen < sizeof(struct ipv6_mreq))

			goto e_inval;



		retv = -EPROTO;

		if (inet_sk(sk)->is_icsk)

			break;
@@ -468,7 +471,7 @@ done: 
	{

		struct ipv6_mreq mreq;



		if (optlen != sizeof(struct ipv6_mreq))

		if (optlen < sizeof(struct ipv6_mreq))

			goto e_inval;



		retv = -EFAULT;
@@ -487,6 +490,9 @@ done: 
		struct group_req greq;

		struct sockaddr_in6 *psin6;



		if (optlen < sizeof(struct group_req))

			goto e_inval;



		retv = -EFAULT;

		if (copy_from_user(&greq, optval, sizeof(struct group_req)))

			break;
@@ -511,7 +517,7 @@ done: 
		struct group_source_req greqs;

		int omode, add;



		if (optlen != sizeof(struct group_source_req))

		if (optlen < sizeof(struct group_source_req))

			goto e_inval;

		if (copy_from_user(&greqs, optval, sizeof(greqs))) {

			retv = -EFAULT;