tree 838fdf59af322352c6a5a5ea036fb07ddb0722a4
parent be609a1fca672655bf831d296685f33ba330e007
author Dan Rosenberg <drosenberg@vsecurity.com> 1289594682 -0800
committer Greg Kroah-Hartman <gregkh@suse.de> 1291929861 -0800

x25: Prevent crashing when parsing bad X.25 facilities

commit 5ef41308f94dcbb3b7afc56cdef1c2ba53fa5d2f upstream.

Now with improved comma support.

On parsing malformed X.25 facilities, decrementing the remaining length
may cause it to underflow.  Since the length is an unsigned integer,
this will result in the loop continuing until the kernel crashes.

This patch adds checks to ensure decrementing the remaining length does
not cause it to wrap around.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>