]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
projects / thirdparty / kernel / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e1a6764) | patch
net: ipmr: limit MRT_TABLE identifiers
authorEric Dumazet <edumazet@google.com>
Sun, 25 Nov 2012 09:44:29 +0000 (09:44 +0000)
committerDavid S. Miller <davem@davemloft.net>
Mon, 26 Nov 2012 22:36:59 +0000 (17:36 -0500)
commitb49d3c1e1c948d76d64790abe9acffa9fa747d19
treedf232ca487f9abb44f5be051addfe7bc8d96f484tree | snapshot
parente1a676424c290b1c8d757e3860170ac7ecd89af4commit | diff
net: ipmr: limit MRT_TABLE identifiers

Name of pimreg devices are built from following format :

char name[IFNAMSIZ]; // IFNAMSIZ == 16

sprintf(name, "pimreg%u", mrt->id);

We must therefore limit mrt->id to 9 decimal digits
or risk a buffer overflow and a crash.

Restrict table identifiers in [0 ... 999999999] interval.

Reported-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/ipmr.c diff | blob | blame | history
A mirror of Linus' kernel repository