diff options
| author | <jgarzik@pretzel.yyz.us> | 2005-05-27 22:07:02 -0400 |
|---|---|---|
| committer | Jeff Garzik <jgarzik@pobox.com> | 2005-05-27 22:07:02 -0400 |
| commit | 1f15d694522af9cd7492695f11dd2dc77b6cf098 (patch) | |
| tree | 7f67a4c38456ec73359d576a5c602d18c3c3ef72 /net/xfrm/xfrm_user.c | |
| parent | fff9cfd99c0f88645c3f50d7476d6c8cef99f140 (diff) | |
| parent | 254feb882a7c6e4e51416dff6a97d847fbbba551 (diff) | |
| download | kernel_samsung_crespo-1f15d694522af9cd7492695f11dd2dc77b6cf098.zip kernel_samsung_crespo-1f15d694522af9cd7492695f11dd2dc77b6cf098.tar.gz kernel_samsung_crespo-1f15d694522af9cd7492695f11dd2dc77b6cf098.tar.bz2 | |
Automatic merge of /spare/repo/netdev-2.6 branch master
Diffstat (limited to 'net/xfrm/xfrm_user.c')
| -rw-r--r-- | net/xfrm/xfrm_user.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 5ddda2c..9750901 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -34,14 +34,21 @@ static int verify_one_alg(struct rtattr **xfrma, enum xfrm_attr_type_t type) { struct rtattr *rt = xfrma[type - 1]; struct xfrm_algo *algp; + int len; if (!rt) return 0; - if ((rt->rta_len - sizeof(*rt)) < sizeof(*algp)) + len = (rt->rta_len - sizeof(*rt)) - sizeof(*algp); + if (len < 0) return -EINVAL; algp = RTA_DATA(rt); + + len -= (algp->alg_key_len + 7U) / 8; + if (len < 0) + return -EINVAL; + switch (type) { case XFRMA_ALG_AUTH: if (!algp->alg_key_len && @@ -162,6 +169,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, struct rtattr *rta = u_arg; struct xfrm_algo *p, *ualg; struct xfrm_algo_desc *algo; + int len; if (!rta) return 0; @@ -173,11 +181,12 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, return -ENOSYS; *props = algo->desc.sadb_alg_id; - p = kmalloc(sizeof(*ualg) + ualg->alg_key_len, GFP_KERNEL); + len = sizeof(*ualg) + (ualg->alg_key_len + 7U) / 8; + p = kmalloc(len, GFP_KERNEL); if (!p) return -ENOMEM; - memcpy(p, ualg, sizeof(*ualg) + ualg->alg_key_len); + memcpy(p, ualg, len); *algpp = p; return 0; } |