x25: Prevent skb overreads when checking call user data

x25_find_listener does not check that the amount of call user data given in the skb is big enough in per-socket comparisons, hence buffer overreads may occur. Fix this by adding a check. Signed-off-by: Matthew Daley <[email protected]> Cc: Eric Dumazet <[email protected]> Cc: Andrew Hendry <[email protected]> Cc: stable <[email protected]> Acked-by: Andrew Hendry <[email protected]> Signed-off-by: David S. Miller <[email protected]>
oleg-nesterov · Oct 17, 2011 · 7f81e25 · 7f81e25
1 parent cb101ed
commit 7f81e25
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
@@ -295,7 +295,8 @@ static struct sock *x25_find_listener(struct x25_address *addr,
 			 * Found a listening socket, now check the incoming
 			 * call user data vs this sockets call user data
 			 */
-			if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
+			if (x25_sk(s)->cudmatchlength > 0 &&
+				skb->len >= x25_sk(s)->cudmatchlength) {
 				if((memcmp(x25_sk(s)->calluserdata.cuddata,
 					skb->data,
 					x25_sk(s)->cudmatchlength)) == 0) {