| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 22 Nov 2011 23:35:13 -0500 From: Xi Wang <xi.wang@...il.com> To: linux-kernel@...r.kernel.org Cc: Joerg Reuter <jreuter@...na.de>, Ralf Baechle <ralf@...ux-mips.org>, David Miller <davem@...emloft.net>, linux-hams@...r.kernel.org, netdev@...r.kernel.org Subject: [PATCH 2/2] ax25: integer overflows in ax25_ctl_ioctl() ax25_ctl_ioctl() misses several bound checks on the user-controlled value. Signed-off-by: Xi Wang <xi.wang@...il.com> --- net/ax25/af_ax25.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index be6a8cf..bd47e22 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -402,14 +402,14 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) break; case AX25_T1: - if (ax25_ctl.arg < 1) + if (ax25_ctl.arg < 1 || ax25_ctl.arg > 30) goto einval_put; ax25->rtt = (ax25_ctl.arg * HZ) / 2; ax25->t1 = ax25_ctl.arg * HZ; break; case AX25_T2: - if (ax25_ctl.arg < 1) + if (ax25_ctl.arg < 1 || ax25_ctl.arg > 20) goto einval_put; ax25->t2 = ax25_ctl.arg * HZ; break; @@ -422,10 +422,14 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) break; case AX25_T3: + if (ax25_ctl.arg > 3600) + goto einval_put; ax25->t3 = ax25_ctl.arg * HZ; break; case AX25_IDLE: + if (ax25_ctl.arg > 65535) + goto einval_put; ax25->idle = ax25_ctl.arg * 60 * HZ; break; -- 1.7.5.4 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists