diff options
| author | David S. Miller <davem@davemloft.net> | 2007-03-09 07:15:40 +0100 |
|---|---|---|
| committer | Adrian Bunk <bunk@stusta.de> | 2007-03-09 07:15:40 +0100 |
| commit | 5edf0f4dfbc697487add3c6eaecca1c9bf285d84 (patch) | |
| tree | c9894b3c449d0f274cb20eed9d04065f7e94a2c8 | |
| parent | e62a305abfd6ec65c6d5aab05ed94109408f4c5c (diff) | |
[IPV6]: Handle np->opt being NULL in ipv6_getsockopt_sticky(). (CVE-2007-1000)
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
| -rw-r--r-- | net/ipv6/ipv6_sockglue.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index f7142ba519ab..03ecbfeab849 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -631,11 +631,15 @@ e_inval: return -EINVAL; } -static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr, +static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt, char __user *optval, int len) { - if (!hdr) + struct ipv6_opt_hdr *hdr; + + if (!opt || !opt->hopopt) return 0; + hdr = opt->hopopt; + len = min_t(int, len, ipv6_optlen(hdr)); if (copy_to_user(optval, hdr, ipv6_optlen(hdr))) return -EFAULT; @@ -779,7 +783,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname, { lock_sock(sk); - len = ipv6_getsockopt_sticky(sk, np->opt->hopopt, + len = ipv6_getsockopt_sticky(sk, np->opt, optval, len); release_sock(sk); return put_user(len, optlen); |