Commit a28398ba authored by Wang Chen's avatar Wang Chen Committed by YOSHIFUJI Hideaki

[IPV6]: Check length of optval provided by user in setsockopt().

Check length of setsockopt's optval, which provided by user, before copy it
from user space.
For POSIX compliant, return -EINVAL for setsockopt of short lengths.
Signed-off-by: default avatarWang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
parent 7f1eced8
...@@ -449,6 +449,9 @@ done: ...@@ -449,6 +449,9 @@ done:
{ {
struct ipv6_mreq mreq; struct ipv6_mreq mreq;
if (optlen < sizeof(struct ipv6_mreq))
goto e_inval;
retv = -EPROTO; retv = -EPROTO;
if (inet_sk(sk)->is_icsk) if (inet_sk(sk)->is_icsk)
break; break;
...@@ -468,7 +471,7 @@ done: ...@@ -468,7 +471,7 @@ done:
{ {
struct ipv6_mreq mreq; struct ipv6_mreq mreq;
if (optlen != sizeof(struct ipv6_mreq)) if (optlen < sizeof(struct ipv6_mreq))
goto e_inval; goto e_inval;
retv = -EFAULT; retv = -EFAULT;
...@@ -487,6 +490,9 @@ done: ...@@ -487,6 +490,9 @@ done:
struct group_req greq; struct group_req greq;
struct sockaddr_in6 *psin6; struct sockaddr_in6 *psin6;
if (optlen < sizeof(struct group_req))
goto e_inval;
retv = -EFAULT; retv = -EFAULT;
if (copy_from_user(&greq, optval, sizeof(struct group_req))) if (copy_from_user(&greq, optval, sizeof(struct group_req)))
break; break;
...@@ -511,7 +517,7 @@ done: ...@@ -511,7 +517,7 @@ done:
struct group_source_req greqs; struct group_source_req greqs;
int omode, add; int omode, add;
if (optlen != sizeof(struct group_source_req)) if (optlen < sizeof(struct group_source_req))
goto e_inval; goto e_inval;
if (copy_from_user(&greqs, optval, sizeof(greqs))) { if (copy_from_user(&greqs, optval, sizeof(greqs))) {
retv = -EFAULT; retv = -EFAULT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment