From 6f7f834c6547e86d98525f0f69339beee5613577 Mon Sep 17 00:00:00 2001
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Thu, 19 May 2005 12:39:49 -0700
Subject: [PATCH] --- yaml --- r: 1265 b: refs/heads/master c:
 31c26852cb2ac77f1d4acb37bcf31f165fd5eb68 h: refs/heads/master i:   1263:
 f65503c2e2c78ed6f97236969f33224f4819d969 v: v3

---
 [refs]                     | 2 +-
 trunk/net/xfrm/xfrm_user.c | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 7006f7d09353..28f8d77c3e3a 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b9e9dead05b19e7f52c9aa00cd3a5b7ac4fcacf4
+refs/heads/master: 31c26852cb2ac77f1d4acb37bcf31f165fd5eb68
diff --git a/trunk/net/xfrm/xfrm_user.c b/trunk/net/xfrm/xfrm_user.c
index 15ba08602aa1..97509011c274 100644
--- a/trunk/net/xfrm/xfrm_user.c
+++ b/trunk/net/xfrm/xfrm_user.c
@@ -34,14 +34,21 @@ static int verify_one_alg(struct rtattr **xfrma, enum xfrm_attr_type_t type)
 {
 	struct rtattr *rt = xfrma[type - 1];
 	struct xfrm_algo *algp;
+	int len;
 
 	if (!rt)
 		return 0;
 
-	if ((rt->rta_len - sizeof(*rt)) < sizeof(*algp))
+	len = (rt->rta_len - sizeof(*rt)) - sizeof(*algp);
+	if (len < 0)
 		return -EINVAL;
 
 	algp = RTA_DATA(rt);
+
+	len -= (algp->alg_key_len + 7U) / 8; 
+	if (len < 0)
+		return -EINVAL;
+
 	switch (type) {
 	case XFRMA_ALG_AUTH:
 		if (!algp->alg_key_len &&