diff options
| author | Ecco Park <eccopark@google.com> | 2017-03-24 10:39:35 -0700 |
|---|---|---|
| committer | Ecco Park <eccopark@google.com> | 2017-03-24 10:39:35 -0700 |
| commit | 368902fb3e3743b676f56772364fd05de069c6fd (patch) | |
| tree | e6f20e4b836e7ec94d02e80b2e2563817b6f3249 | |
| parent | 6583c9604db850cd207d64856e2da566a5d049cf (diff) | |
| parent | b81247537bc247f59fa68e39ea0144b75cf1305b (diff) | |
Merge branch 'android-msm-bullhead-3.10-nyc-mr1' into android-msm-bullhead-3.10-nyc-mr2android-7.1.2_r0.10
May 2017.3
Bug: 36138302
| -rw-r--r-- | net/xfrm/xfrm_user.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 7a70a5a5671a..91a6a2903e8d 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -390,7 +390,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es up = nla_data(rp); ulen = xfrm_replay_state_esn_len(up); - if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen) + /* Check the overall length and the internal bitmap length to avoid + * potential overflow. */ + if (nla_len(rp) < ulen || + xfrm_replay_state_esn_len(replay_esn) != ulen || + replay_esn->bmp_len != up->bmp_len) + return -EINVAL; + + if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) return -EINVAL; return 0; |