From 2aedfd65e3bc7a17919c0819fa571eb27a979992 Mon Sep 17 00:00:00 2001 From: David Stevens Date: Thu, 19 Feb 2004 17:40:25 -0800 Subject: [PATCH] [IGMP/MLD]: Validate filter size against optlen. --- net/ipv4/ip_sockglue.c | 5 +++++ net/ipv6/ipv6_sockglue.c | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index e889d2f5baa2c..ec46daa8cabac 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -631,6 +631,11 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char *optval, int opt kfree(msf); break; } + if (IP_MSFILTER_SIZE(msf->imsf_numsrc) > optlen) { + kfree(msf); + err = -EINVAL; + break; + } err = ip_mc_msfilter(sk, msf, 0); kfree(msf); break; diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 52c02189c483f..f92cbcd4d4b0a 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -450,6 +450,11 @@ done: kfree(gsf); break; } + if (GROUP_FILTER_SIZE(gsf->gf_numsrc) > optlen) { + kfree(gsf); + retv = -EINVAL; + break; + } retv = ip6_mc_msfilter(sk, gsf); kfree(gsf); -- 2.53.0