linux/net/x25
Dan Rosenberg 5ef41308f9 x25: Prevent crashing when parsing bad X.25 facilities
Now with improved comma support.

On parsing malformed X.25 facilities, decrementing the remaining length
may cause it to underflow.  Since the length is an unsigned integer,
this will result in the loop continuing until the kernel crashes.

This patch adds checks to ensure decrementing the remaining length does
not cause it to wrap around.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-11-12 12:44:42 -08:00
..
af_x25.c X.25 remove bkl in poll 2010-09-22 13:35:51 -07:00
Kconfig BKL: introduce CONFIG_BKL. 2010-10-21 15:44:13 +02:00
Makefile
sysctl_net_x25.c sysctl net: Remove unused binary sysctl code 2009-11-12 02:05:06 -08:00
x25_dev.c X25: Add if_x25.h and x25 to device identifiers 2010-04-22 16:12:36 -07:00
x25_facilities.c x25: Prevent crashing when parsing bad X.25 facilities 2010-11-12 12:44:42 -08:00
x25_forward.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
x25_in.c memory corruption in X.25 facilities parsing 2010-11-03 18:50:50 -07:00
x25_link.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
x25_out.c X25: Move interrupt flag to bitfield 2010-05-17 17:39:27 -07:00
x25_proc.c net: x25: use seq_list_foo() helpers 2010-02-10 11:12:10 -08:00
x25_route.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
x25_subr.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
x25_timer.c x25: Fix sleep from timer on socket destroy. 2009-06-16 05:40:30 -07:00