diff options
| author | Paul Moore <paul.moore@hp.com> | 2007-01-05 23:08:22 +0300 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2007-01-09 11:30:01 +0300 |
| commit | 2a2f11c227bdf292b3a2900ad04139d301b56ac4 (patch) | |
| tree | e94ced56b21fa9258dc6d8c9d8b1e1a3f6e190a1 | |
| parent | 797951200679f1d5ea12a2e58cc7bdbc2848764c (diff) | |
| download | linux-2a2f11c227bdf292b3a2900ad04139d301b56ac4.tar.xz | |
NetLabel: correct CIPSO tag handling when adding new DOI definitions
The current netlbl_cipsov4_add_common() function has two problems which are
fixed with this patch. The first is an off-by-one bug where it is possibile to
overflow the doi_def->tags[] array. The second is a bug where the same
doi_def->tags[] array was not always fully initialized, which caused sporadic
failures.
Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
| -rw-r--r-- | net/netlabel/netlabel_cipso_v4.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c index 4afc75f9e377..73e0ff469bff 100644 --- a/net/netlabel/netlabel_cipso_v4.c +++ b/net/netlabel/netlabel_cipso_v4.c @@ -130,12 +130,12 @@ static int netlbl_cipsov4_add_common(struct genl_info *info, nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem) if (nla->nla_type == NLBL_CIPSOV4_A_TAG) { - if (iter > CIPSO_V4_TAG_MAXCNT) + if (iter >= CIPSO_V4_TAG_MAXCNT) return -EINVAL; doi_def->tags[iter++] = nla_get_u8(nla); } - if (iter < CIPSO_V4_TAG_MAXCNT) - doi_def->tags[iter] = CIPSO_V4_TAG_INVALID; + while (iter < CIPSO_V4_TAG_MAXCNT) + doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID; return 0; } |