diff options
| author | Takashi Iwai <tiwai@suse.de> | 2017-05-02 08:25:25 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2017-05-02 08:25:25 +0200 |
| commit | a5c3b32a1146e44f6b38fdfdfffc27842953420c (patch) | |
| tree | eca93f51c8deabe77ed079a3e9190717b6380009 /net/xfrm/xfrm_user.c | |
| parent | d7dc450d5a7162de96edbed6b1792240c2f3a55f (diff) | |
| parent | 20d5c84bef067b7e804a163e2abca16c47125bad (diff) | |
| download | talos-op-linux-a5c3b32a1146e44f6b38fdfdfffc27842953420c.tar.gz talos-op-linux-a5c3b32a1146e44f6b38fdfdfffc27842953420c.zip | |
Merge tag 'asoc-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Updates for v4.12
A quiet release for the core, but lots of new drivers this time around:
- A new, generalized, API for hooking up jacks which makes it easier to
write generic machine drivers for simple cases.
- Continuing fixes for issues with the x86 CPU drivers.
- New drivers for Cirrus CS35L35, DIO DIO2125, Everest ES7132,
HiSilicon hi6210, Maxim MAX98927, MT2701 systems with WM8960, Nuvoton
NAU8824, Odroid systems, ST STM32 SAI controllers and x86 systems with
DA7213
Diffstat (limited to 'net/xfrm/xfrm_user.c')
| -rw-r--r-- | net/xfrm/xfrm_user.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 9705c279494b..40a8aa39220d 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -412,7 +412,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es up = nla_data(rp); ulen = xfrm_replay_state_esn_len(up); - if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen) + /* Check the overall length and the internal bitmap length to avoid + * potential overflow. */ + if (nla_len(rp) < ulen || + xfrm_replay_state_esn_len(replay_esn) != ulen || + replay_esn->bmp_len != up->bmp_len) + return -EINVAL; + + if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) return -EINVAL; return 0; |
