From c6de5288d3201ca9a74facbe7d4232c6c9172124 Mon Sep 17 00:00:00 2001 From: andrew hendry Date: Wed, 3 Nov 2010 12:54:53 +0000 Subject: [PATCH] --- yaml --- r: 221630 b: refs/heads/master c: a6331d6f9a4298173b413cf99a40cc86a9d92c37 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/net/x25/x25_facilities.c | 8 ++++---- trunk/net/x25/x25_in.c | 2 ++ 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/[refs] b/[refs] index 06fbeba19615..d466997ac08d 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 41bb78b4b9adb21cf2c395b6b880aaae99c788b7 +refs/heads/master: a6331d6f9a4298173b413cf99a40cc86a9d92c37 diff --git a/trunk/net/x25/x25_facilities.c b/trunk/net/x25/x25_facilities.c index 771bab00754b..3a8c4c419cd4 100644 --- a/trunk/net/x25/x25_facilities.c +++ b/trunk/net/x25/x25_facilities.c @@ -134,15 +134,15 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities, case X25_FAC_CLASS_D: switch (*p) { case X25_FAC_CALLING_AE: - if (p[1] > X25_MAX_DTE_FACIL_LEN) - break; + if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1) + return 0; dte_facs->calling_len = p[2]; memcpy(dte_facs->calling_ae, &p[3], p[1] - 1); *vc_fac_mask |= X25_MASK_CALLING_AE; break; case X25_FAC_CALLED_AE: - if (p[1] > X25_MAX_DTE_FACIL_LEN) - break; + if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1) + return 0; dte_facs->called_len = p[2]; memcpy(dte_facs->called_ae, &p[3], p[1] - 1); *vc_fac_mask |= X25_MASK_CALLED_AE; diff --git a/trunk/net/x25/x25_in.c b/trunk/net/x25/x25_in.c index 63178961efac..f729f022be69 100644 --- a/trunk/net/x25/x25_in.c +++ b/trunk/net/x25/x25_in.c @@ -119,6 +119,8 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp &x25->vc_facil_mask); if (len > 0) skb_pull(skb, len); + else + return -1; /* * Copy any Call User Data. */