1 files changed, 13 insertions, 7 deletions

diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 771bab00754..55187c8f642 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -61,6 +61,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
         while (len > 0) {
                 switch (*p & X25_FAC_CLASS_MASK) {
                 case X25_FAC_CLASS_A:
+                        if (len < 2)
+                                return 0;
                         switch (*p) {
                         case X25_FAC_REVERSE:
                                 if((p[1] & 0x81) == 0x81) {
@@ -104,6 +106,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         len -= 2;
                         break;
                 case X25_FAC_CLASS_B:
+                        if (len < 3)
+                                return 0;
                         switch (*p) {
                         case X25_FAC_PACKET_SIZE:
                                 facilities->pacsize_in  = p[1];
@@ -125,6 +129,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         len -= 3;
                         break;
                 case X25_FAC_CLASS_C:
+                        if (len < 4)
+                                return 0;
                         printk(KERN_DEBUG "X.25: unknown facility %02X, "
                                "values %02X, %02X, %02X\n",
                                p[0], p[1], p[2], p[3]);
@@ -132,26 +138,26 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         len -= 4;
                         break;
                 case X25_FAC_CLASS_D:
+                        if (len < p[1] + 2)
+                                return 0;
                         switch (*p) {
                         case X25_FAC_CALLING_AE:
-                                if (p[1] > X25_MAX_DTE_FACIL_LEN)
-                                        break;
+                                if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+                                        return 0;
                                 dte_facs->calling_len = p[2];
                                 memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLING_AE;
                                 break;
                         case X25_FAC_CALLED_AE:
-                                if (p[1] > X25_MAX_DTE_FACIL_LEN)
-                                        break;
+                                if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+                                        return 0;
                                 dte_facs->called_len = p[2];
                                 memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLED_AE;
                                 break;
                         default:
                                 printk(KERN_DEBUG "X.25: unknown facility %02X,"
-                                        "length %d, values %02X, %02X, "
-                                        "%02X, %02X\n",
-                                        p[0], p[1], p[2], p[3], p[4], p[5]);
+                                        "length %d\n", p[0], p[1]);
                                 break;
                         }
                         len -= p[1] + 2;