diff options
author | Ingo Molnar <mingo@elte.hu> | 2008-06-16 10:17:15 +0200 |
---|---|---|
committer | Ingo Molnar <mingo@elte.hu> | 2008-06-16 10:17:15 +0200 |
commit | 28638ea4f8adb63f837e4436560ab16ab0388587 (patch) | |
tree | 2dab7a03d7696697c82ba62a03700d3a2f3639b1 /net/ipv4/netfilter/nf_nat_snmp_basic.c | |
parent | f781b03c4b1c713ac000877c8bbc31fc4164a29b (diff) | |
parent | 066519068ad2fbe98c7f45552b1f592903a9c8c8 (diff) |
Merge branch 'linus' into x86/nmitip-x86-nmi-2008-06-16_09.20_Mon
Conflicts:
arch/x86/kernel/nmi_32.c
Diffstat (limited to 'net/ipv4/netfilter/nf_nat_snmp_basic.c')
-rw-r--r-- | net/ipv4/netfilter/nf_nat_snmp_basic.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c index 5daefad3d193..7750c97fde7b 100644 --- a/net/ipv4/netfilter/nf_nat_snmp_basic.c +++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c @@ -232,6 +232,11 @@ static unsigned char asn1_length_decode(struct asn1_ctx *ctx, } } } + + /* don't trust len bigger than ctx buffer */ + if (*len > ctx->end - ctx->pointer) + return 0; + return 1; } @@ -250,6 +255,10 @@ static unsigned char asn1_header_decode(struct asn1_ctx *ctx, if (!asn1_length_decode(ctx, &def, &len)) return 0; + /* primitive shall be definite, indefinite shall be constructed */ + if (*con == ASN1_PRI && !def) + return 0; + if (def) *eoc = ctx->pointer + len; else @@ -434,6 +443,11 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx, unsigned long *optr; size = eoc - ctx->pointer + 1; + + /* first subid actually encodes first two subids */ + if (size < 2 || size > ULONG_MAX/sizeof(unsigned long)) + return 0; + *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC); if (*oid == NULL) { if (net_ratelimit()) |