diff options
| author | Wei Yongjun <yjwei@cn.fujitsu.com> | 2009-03-02 09:46:12 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-03-02 22:49:17 -0800 |
| commit | c6db93a58f1745cfe1acc2e1a1d68afc3245eced (patch) | |
| tree | b4e88d10bc75fa6565d91202460fb3f0ed5cc7c5 /net/sctp/socket.c | |
| parent | d212318c9d1b11ff44b57f90b4f9d9c9b31a6ced (diff) | |
| download | linux-c6db93a58f1745cfe1acc2e1a1d68afc3245eced.tar.bz2 | |
sctp: fix the length check in sctp_getsockopt_maxburst()
The code in sctp_getsockopt_maxburst() doesn't allow len to be larger
then struct sctp_assoc_value, which is a common case where app writers
just pass down the sizeof(buf) or something similar.
This patch fix the problem.
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp/socket.c')
| -rw-r--r-- | net/sctp/socket.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 4bc558c19fcf..bbd3cd238d7f 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -5286,7 +5286,8 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len, printk(KERN_WARNING "SCTP: Use struct sctp_assoc_value instead\n"); params.assoc_id = 0; - } else if (len == sizeof (struct sctp_assoc_value)) { + } else if (len >= sizeof(struct sctp_assoc_value)) { + len = sizeof(struct sctp_assoc_value); if (copy_from_user(¶ms, optval, len)) return -EFAULT; } else |