Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
  • Register
  • Sign in
  • L linux
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 0
    • Issues 0
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 0
    • Merge requests 0
  • Deployments
    • Deployments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Commits
  • Issue Boards
Collapse sidebar
  • Kirill Smelkov
  • linux
  • Repository
  • linux
  • net
  • socket.c
Find file BlameHistoryPermalink
  • Dan Carpenter's avatar
    net: clamp ->msg_namelen instead of returning an error · db31c55a
    Dan Carpenter authored Nov 27, 2013
    If kmsg->msg_namelen > sizeof(struct sockaddr_storage) then in the
    original code that would lead to memory corruption in the kernel if you
    had audit configured.  If you didn't have audit configured it was
    harmless.
    
    There are some programs such as beta versions of Ruby which use too
    large of a buffer and returning an error code breaks them.  We should
    clamp the ->msg_namelen value instead.
    
    Fixes: 1661bf36
    
     ("net: heap overflow in __audit_sockaddr()")
    Reported-by: default avatarEric Wong <normalperson@yhbt.net>
    Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
    Tested-by: default avatarEric Wong <normalperson@yhbt.net>
    Acked-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    db31c55a
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7