diff options
Diffstat (limited to 'net/sctp/socket.c')
| -rw-r--r-- | net/sctp/socket.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 7eec0a0b7f79..5e4100df7bae 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -3924,13 +3924,17 @@ static int sctp_setsockopt_reset_streams(struct sock *sk, struct sctp_association *asoc; int retval = -EINVAL; - if (optlen < sizeof(struct sctp_reset_streams)) + if (optlen < sizeof(*params)) return -EINVAL; params = memdup_user(optval, optlen); if (IS_ERR(params)) return PTR_ERR(params); + if (params->srs_number_streams * sizeof(__u16) > + optlen - sizeof(*params)) + goto out; + asoc = sctp_id2assoc(sk, params->srs_assoc_id); if (!asoc) goto out; |