Matthew Daley c7fd0d48bd x25: Validate incoming call user data lengths ...

X.25 call user data is being copied in its entirety from incoming messages
without consideration to the size of the destination buffers, leading to
possible buffer overflows. Validate incoming call user data lengths before
these copies are performed.

It appears this issue was noticed some time ago, however nothing seemed to
come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and
commit 8db09f26f912f7c90c764806e804b558da520d4f.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Andrew Hendry <andrew.hendry@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

2011-10-17 19:31:39 -04:00

..

af_x25.c

x25: Validate incoming call user data lengths

2011-10-17 19:31:39 -04:00

Kconfig

x25: remove the BKL

2011-03-05 10:55:45 +01:00

Makefile

[X.25]: Add call forwarding

2007-02-08 13:34:02 -08:00

sysctl_net_x25.c

sysctl net: Remove unused binary sysctl code

2009-11-12 02:05:06 -08:00

x25_dev.c

x25: Reduce switch/case indent

2011-07-01 16:11:16 -07:00

x25_facilities.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

x25_forward.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

x25_in.c

x25: Validate incoming call user data lengths

2011-10-17 19:31:39 -04:00

x25_link.c

x25: Reduce switch/case indent

2011-07-01 16:11:16 -07:00

x25_out.c

x25: remove the BKL

2011-03-05 10:55:45 +01:00

x25_proc.c

net: x25: use seq_list_foo() helpers

2010-02-10 11:12:10 -08:00

x25_route.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

x25_subr.c

x25: Reduce switch/case indent

2011-07-01 16:11:16 -07:00

x25_timer.c

x25: Fix sleep from timer on socket destroy.

2009-06-16 05:40:30 -07:00