af_rose/x25: Sanity check the maximum user frame size

upstream commit: 83e0bbcbe2145f160fbaa109b0439dae7f4a38a9

CVE-2009-0795.

Otherwise we can wrap the sizes and end up sending garbage.

Closes #10423

Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index e9c05b8f4f4517fc5b13b6295eebfd1cf75e0a1c..2d7fbe7e12db95e8265b485871261ea2ca0ea189 100644 (file)
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1082,7 +1082,11 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
 
        SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
 
-       /* Build a packet */
+       /* Build a packet - the conventional user limit is 236 bytes. We can
+          do ludicrously large NetROM frames but must not overflow */
+       if (len > 65536)
+               return -EMSGSIZE;
+
        SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
        size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
 

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 01392649b4626d930eaba64175a5e50f1dc1f57c..5e75bbf077db63c139fdfd0d166bdd582e4e21e1 100644 (file)
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1124,6 +1124,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
 
        /* Build a packet */
        SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
+       /* Sanity check the packet size */
+       if (len > 65535)
+               return -EMSGSIZE;
+
        size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
 
        if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 9fc5b023d1118a990944cbe32ff5ab2c81e07f5b..88d80f55facc48dea14df60277394949205bef67 100644 (file)
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1037,6 +1037,12 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
                sx25.sx25_addr   = x25->dest_addr;
        }
 
+       /* Sanity check the packet size */
+       if (len > 65535) {
+               rc = -EMSGSIZE;
+               goto out;
+       }
+
        SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
 
        /* Build a packet */