| From foo@baz Mon Jan 18 21:18:36 PST 2016 |
| From: WANG Cong <xiyou.wangcong@gmail.com> |
| Date: Mon, 14 Dec 2015 13:48:36 -0800 |
| Subject: pptp: verify sockaddr_len in pptp_bind() and pptp_connect() |
| Status: RO |
| Content-Length: 993 |
| Lines: 36 |
| |
| From: WANG Cong <xiyou.wangcong@gmail.com> |
| |
| [ Upstream commit 09ccfd238e5a0e670d8178cf50180ea81ae09ae1 ] |
| |
| Reported-by: Dmitry Vyukov <dvyukov@gmail.com> |
| Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/ppp/pptp.c | 6 ++++++ |
| 1 file changed, 6 insertions(+) |
| |
| --- a/drivers/net/ppp/pptp.c |
| +++ b/drivers/net/ppp/pptp.c |
| @@ -420,6 +420,9 @@ static int pptp_bind(struct socket *sock |
| struct pptp_opt *opt = &po->proto.pptp; |
| int error = 0; |
| |
| + if (sockaddr_len < sizeof(struct sockaddr_pppox)) |
| + return -EINVAL; |
| + |
| lock_sock(sk); |
| |
| opt->src_addr = sp->sa_addr.pptp; |
| @@ -441,6 +444,9 @@ static int pptp_connect(struct socket *s |
| struct flowi4 fl4; |
| int error = 0; |
| |
| + if (sockaddr_len < sizeof(struct sockaddr_pppox)) |
| + return -EINVAL; |
| + |
| if (sp->sa_protocol != PX_PROTO_PPTP) |
| return -EINVAL; |
| |
