diff options
| author | Kees Cook <keescook@chromium.org> | 2018-02-15 00:45:07 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-02-16 21:16:05 +0100 |
| commit | fe9c842695e26d8116b61b80bfb905356f07834b (patch) | |
| tree | 4290060a267efbab9953477c6e8a0e5751be97e2 /net/ipv6 | |
| parent | tls: getsockopt return record sequence number (diff) | |
| download | linux-fe9c842695e26d8116b61b80bfb905356f07834b.tar.xz linux-fe9c842695e26d8116b61b80bfb905356f07834b.zip | |
NFC: llcp: Limit size of SDP URI
The tlv_len is u8, so we need to limit the size of the SDP URI. Enforce
this both in the NLA policy and in the code that performs the allocation
and copy, to avoid writing past the end of the allocated buffer.
Fixes: d9b8d8e19b073 ("NFC: llcp: Service Name Lookup netlink interface")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
0 files changed, 0 insertions, 0 deletions