---

yaml --- r: 1265 b: refs/heads/master c: 31c2685 h: refs/heads/master i: 1263: f65503c v: v3
git-mirror · May 19, 2005 · 6f7f834 · 6f7f834
1 parent 74e1b70
commit 6f7f834
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b9e9dead05b19e7f52c9aa00cd3a5b7ac4fcacf4
+refs/heads/master: 31c26852cb2ac77f1d4acb37bcf31f165fd5eb68
diff --git a/trunk/net/xfrm/xfrm_user.c b/trunk/net/xfrm/xfrm_user.c
@@ -34,14 +34,21 @@ static int verify_one_alg(struct rtattr **xfrma, enum xfrm_attr_type_t type)
 {
 	struct rtattr *rt = xfrma[type - 1];
 	struct xfrm_algo *algp;
+	int len;
 
 	if (!rt)
 		return 0;
 
-	if ((rt->rta_len - sizeof(*rt)) < sizeof(*algp))
+	len = (rt->rta_len - sizeof(*rt)) - sizeof(*algp);
+	if (len < 0)
 		return -EINVAL;
 
 	algp = RTA_DATA(rt);
+
+	len -= (algp->alg_key_len + 7U) / 8; 
+	if (len < 0)
+		return -EINVAL;
+
 	switch (type) {
 	case XFRMA_ALG_AUTH:
 		if (!algp->alg_key_len &&