Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

[IPSEC]: Verify key payload in verify_one_algo

Browse source 
We need to verify that the payload contains enough data so that
attach_one_algo can copy alg_key_len bits from the payload.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Herbert Xu 2005-05-19 12:39:49 -07:00 committed by David S. Miller
parent b9e9dead05
commit 31c26852cb
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
net/xfrm/xfrm_user.c
View file

@ -34,14 +34,21 @@ static int verify_one_alg(struct rtattr **xfrma, enum xfrm_attr_type_t type)
{ {
struct rtattr *rt = xfrma[type - 1]; struct rtattr *rt = xfrma[type - 1];
struct xfrm_algo *algp; struct xfrm_algo *algp;
int len;
if (!rt) if (!rt)
return 0; return 0;
if ((rt->rta_len - sizeof(*rt)) < sizeof(*algp)) len = (rt->rta_len - sizeof(*rt)) - sizeof(*algp);
if (len < 0)
return -EINVAL; return -EINVAL;
algp = RTA_DATA(rt); algp = RTA_DATA(rt);
len -= (algp->alg_key_len + 7U) / 8;
if (len < 0)
return -EINVAL;
switch (type) { switch (type) {
case XFRMA_ALG_AUTH: case XFRMA_ALG_AUTH:
if (!algp->alg_key_len && if (!algp->alg_key_len &&