bluetooth: Validate socket address length in sco_sock_bind().

Change-Id: I890640975f1af64f71947b6a1820249e08f6375b
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2015-12-15 15:39:08 -05:00 committed by Zhao Wei Liew
parent 504d01b884
commit 29b4575124

View file

@ -499,6 +499,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
if (!addr || addr->sa_family != AF_BLUETOOTH)
return -EINVAL;
if (alen < sizeof(struct sockaddr_sco))
return -EINVAL;
memset(&sa, 0, sizeof(sa));
len = min_t(unsigned int, sizeof(sa), alen);
memcpy(&sa, addr, len);