Dan Carpenter f674e72ff1 net/key/af_key.c: add range checks on ->sadb_x_policy_len ...

Because sizeof() is size_t then if "len" is negative, it counts as a
large positive value.

The call tree looks like:
pfkey_sendmsg()
-> pfkey_process()
   -> pfkey_spdadd()
      -> parse_ipsecrequests()

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2012-10-01 17:15:06 -04:00

..

af_key.c

net/key/af_key.c: add range checks on ->sadb_x_policy_len

2012-10-01 17:15:06 -04:00

Makefile

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00