1. 30 12月, 2008 37 次提交
  2. 29 12月, 2008 2 次提交
  3. 26 12月, 2008 1 次提交
    • V
      netlink: fix (theoretical) overrun in message iteration · 619e803d
      Vegard Nossum 提交于
      See commit 1045b03e ("netlink: fix
      overrun in attribute iteration") for a detailed explanation of why
      this patch is necessary.
      
      In short, nlmsg_next() can make "remaining" go negative, and the
      remaining >= sizeof(...) comparison will promote "remaining" to an
      unsigned type, which means that the expression will evaluate to
      true for negative numbers, even though it was not intended.
      
      I put "theoretical" in the title because I have no evidence that
      this can actually happen, but I suspect that a crafted netlink
      packet can trigger some badness.
      
      Note that the last test, which seemingly has the exact same
      problem (also true for nla_ok()), is perfectly OK, since we
      already know that remaining is positive.
      Signed-off-by: NVegard Nossum <vegard.nossum@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      619e803d