diff options
| author | Bulbul Dabi <bdabi@codeaurora.org> | 2016-11-23 16:57:47 +0530 |
|---|---|---|
| committer | Bulbul Dabi <bdabi@codeaurora.org> | 2016-11-23 17:36:43 +0530 |
| commit | c1610c6a6a51943265ff1c38b814ff4c04eaab12 (patch) | |
| tree | 8662b02df109c15110dafa186b50e71849e8d5a4 | |
| parent | 0daf5baf77a7aba19bcd301e74c01b6665d51732 (diff) | |
net: add additional args validation in ping_common_sendmsg()android-wear-7.0.0_r0.9
adding validation of the len variable in ping_common_sendmsg()
to check if its less than icmph_len which canleading to a
overflow issues.
addressing issue reported under CVE-2016-8399 A-31349935 and
suggestion.
Change-Id: I98f7b070b41312832b6a347ea1c11b9c700159a7
Signed-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>
| -rw-r--r-- | net/ipv4/ping.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c index f8c8f60ad7e2..aaa70dd66667 100644 --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c @@ -651,7 +651,7 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len, void *user_icmph, size_t icmph_len) { u8 type, code; - if (len > 0xFFFF) + if (len > 0xFFFF || len < icmph_len) return -EMSGSIZE; /* |