• X
    ax25: avoid overflows in ax25_setsockopt() · ba1cffe0
    Xi Wang 提交于
    Commit be639ac6 ("NET: AX.25: Check ioctl arguments to avoid overflows
    further down the road") rejects very large arguments, but doesn't
    completely fix overflows on 64-bit systems.  Consider the AX25_T2 case.
    
    	int opt;
    	...
    	if (opt < 1 || opt > ULONG_MAX / HZ) {
    		res = -EINVAL;
    		break;
    	}
    	ax25->t2 = opt * HZ;
    
    The 32-bit multiplication opt * HZ would overflow before being assigned
    to 64-bit ax25->t2.  This patch changes "opt" to unsigned long.
    Signed-off-by: NXi Wang <xi.wang@gmail.com>
    Cc: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    ba1cffe0
af_ax25.c 44.0 KB