]> git.baikalelectronics.ru Git - kernel.git/commit
tipc: fix out of bounds indexing
authorErik Hugne <erik.hugne@ericsson.com>
Mon, 28 Apr 2014 06:20:09 +0000 (08:20 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 28 Apr 2014 18:43:35 +0000 (14:43 -0400)
commit22530427eb7355fe899d862707518d52533b1e3c
treec8c320eb97da04533e2c8e7f1e81bb4f3ee92376
parent866fefb8dcab9a75f68ac6abf13c2a479de4d2c2
tipc: fix out of bounds indexing

Commit 84cc4b1b29e6c45847d85eab4180d6985dbf76e1 ("tipc: add
ioctl to fetch link names") introduced a buffer overflow bug where
specially crafted ioctl requests could cause out-of-bounds indexing
of the node->links array. This was caused by an incorrect check vs
MAX_BEARERS, and the static code checker complaint is:
net/tipc/node.c:459 tipc_node_get_linkname() error: buffer overflow 'node->links' 2 <= 2

Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/node.c