[PATCH] Fix minor security hole

ROSE wasn't verifying the ndigis argument of a new route resulting in a
minor security hole.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@osdl.org>

diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 92674a1cc49ea6640a070e32e03fa1027568414c..d19d931a1a75a26bb4395fae73c0dd1efab16d45 100644 (file)
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -727,7 +727,8 @@ int rose_rt_ioctl(unsigned int cmd, void __user *arg)
                }
                if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
                        return -EINVAL;
-
+               if (rose_route.ndigis > 8) /* No more than 8 digipeats */
+                       return -EINVAL;
                err = rose_add_node(&rose_route, dev);
                dev_put(dev);
                return err;