This is a note to let you know that I've just added the patch titled
irda: validate peer name and attribute lengths
to the 2.6.38-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
irda-validate-peer-name-and-attribute-lengths.patch
and it can be found in the queue-2.6.38 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From d370af0ef7951188daeb15bae75db7ba57c67846 Mon Sep 17 00:00:00 2001
From: Dan Rosenberg <[email protected]>
Date: Sun, 20 Mar 2011 15:32:06 +0000
Subject: irda: validate peer name and attribute lengths
From: Dan Rosenberg <[email protected]>
commit d370af0ef7951188daeb15bae75db7ba57c67846 upstream.
Length fields provided by a peer for names and attributes may be longer
than the destination array sizes. Validate lengths to prevent stack
buffer overflows.
Signed-off-by: Dan Rosenberg <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/irda/iriap.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -656,10 +656,16 @@ static void iriap_getvaluebyclass_indica
n = 1;
name_len = fp[n++];
+
+ IRDA_ASSERT(name_len < IAS_MAX_CLASSNAME + 1, return;);
+
memcpy(name, fp+n, name_len); n+=name_len;
name[name_len] = '\0';
attr_len = fp[n++];
+
+ IRDA_ASSERT(attr_len < IAS_MAX_ATTRIBNAME + 1, return;);
+
memcpy(attr, fp+n, attr_len); n+=attr_len;
attr[attr_len] = '\0';
Patches currently in stable-queue which might be from [email protected]
are
queue-2.6.38/irda-prevent-heap-corruption-on-invalid-nickname.patch
queue-2.6.38/irda-validate-peer-name-and-attribute-lengths.patch
queue-2.6.38/sound-oss-opl3-validate-voice-and-channel-indexes.patch
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
