summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2007-03-09 07:15:40 +0100
committerAdrian Bunk <bunk@stusta.de>2007-03-09 07:15:40 +0100
commit5edf0f4dfbc697487add3c6eaecca1c9bf285d84 (patch)
treec9894b3c449d0f274cb20eed9d04065f7e94a2c8 /net
parente62a305abfd6ec65c6d5aab05ed94109408f4c5c (diff)
[IPV6]: Handle np->opt being NULL in ipv6_getsockopt_sticky(). (CVE-2007-1000)
Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
Diffstat (limited to 'net')
-rw-r--r--net/ipv6/ipv6_sockglue.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index f7142ba519ab..03ecbfeab849 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -631,11 +631,15 @@ e_inval:
return -EINVAL;
}
-static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
+static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
char __user *optval, int len)
{
- if (!hdr)
+ struct ipv6_opt_hdr *hdr;
+
+ if (!opt || !opt->hopopt)
return 0;
+ hdr = opt->hopopt;
+
len = min_t(int, len, ipv6_optlen(hdr));
if (copy_to_user(optval, hdr, ipv6_optlen(hdr)))
return -EFAULT;
@@ -779,7 +783,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
{
lock_sock(sk);
- len = ipv6_getsockopt_sticky(sk, np->opt->hopopt,
+ len = ipv6_getsockopt_sticky(sk, np->opt,
optval, len);
release_sock(sk);
return put_user(len, optlen);