Attachment 18473 Details for Bug 54207

[patch] minimal patch from Dave Jones.

foo (text/plain), 1.11 KB, created by Marcus Meissner on 2004-04-21 04:56:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2004-04-21 04:56:30 UTC

Size: 1.11 KB

patch

obsolete

>Here's the bare minimum fix I'm going to be rolling into our
>Fedora update in case anyone else wants this sysctl-free approach.
>
>		Dave
>
>--- linux-2.4.22/net/ipv4/ip_sockglue.c~	2004-04-20 14:05:44.000000000 +0100
>+++ linux-2.4.22/net/ipv4/ip_sockglue.c	2004-04-20 14:10:50.000000000 +0100
>@@ -760,6 +760,11 @@
> 			if (copy_from_user(gsf, optval, optlen)) {
> 				goto mc_msf_out;
> 			}
>+			/* numsrc >= (4G-140)/128 overflow in 32 bits */
>+			if (gsf->gf_numsrc >= 0x1ffffff) {
>+				err = -ENOBUFS;
>+				goto mc_msf_out;
>+			}
> 			if (GROUP_FILTER_SIZE(gsf->gf_numsrc) < optlen) {
> 				err = EINVAL;
> 				goto mc_msf_out;
>--- linux-2.4.22/net/ipv6/ipv6_sockglue.c~	2004-04-20 14:11:00.000000000 +0100
>+++ linux-2.4.22/net/ipv6/ipv6_sockglue.c	2004-04-20 14:18:05.000000000 +0100
>@@ -466,6 +466,17 @@
> 			kfree(gsf);
> 			break;
> 		}
>+		/* numsrc >= (4G-140)/128 overflow in 32 bits */
>+		if (gsf->gf_numsrc >= 0x1ffffffU) {
>+			kfree(gsf);
>+			retv = -ENOBUFS;
>+			break;
>+		}
>+		if (GROUP_FILTER_SIZE(gsf->gf_numsrc) > optlen) {
>+			kfree(gsf);
>+			retv = -EINVAL;
>+			break;
>+		}
> 		retv = ip6_mc_msfilter(sk, gsf);
> 		kfree(gsf);
>

Actions: View | Diff

Attachments on bug 54207: 18473