-
Matthew Daley authored
X.25 call user data is being copied in its entirety from incoming messages without consideration to the size of the destination buffers, leading to possible buffer overflows. Validate incoming call user data lengths before these copies are performed. It appears this issue was noticed some time ago, however nothing seemed to come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and commit 8db09f26. Signed-off-by:
Matthew Daley <mattjd@gmail.com> Acked-by:
Eric Dumazet <eric.dumazet@gmail.com> Tested-by:
Andrew Hendry <andrew.hendry@gmail.com> Cc: stable <stable@kernel.org> Signed-off-by:
David S. Miller <davem@davemloft.net>
c7fd0d48