aboutsummaryrefslogtreecommitdiffstats
path: root/net/netrom/af_netrom.c
diff options
context:
space:
mode:
authorAlan Cox <alan@lxorguk.ukuu.org.uk>2009-03-27 03:28:21 -0400
committerDavid S. Miller <davem@davemloft.net>2009-03-27 03:28:21 -0400
commit83e0bbcbe2145f160fbaa109b0439dae7f4a38a9 (patch)
treede3f516afc1878914855c9393b1e08c698ac378c /net/netrom/af_netrom.c
parent03ba999117eb8688252f9068356b6e028c2c3a56 (diff)
af_rose/x25: Sanity check the maximum user frame size
Otherwise we can wrap the sizes and end up sending garbage. Closes #10423 Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netrom/af_netrom.c')
-rw-r--r--net/netrom/af_netrom.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 6d9c58ec56ac..d1c16bbee932 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1086,7 +1086,11 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
1086 1086
1087 SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n"); 1087 SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
1088 1088
1089 /* Build a packet */ 1089 /* Build a packet - the conventional user limit is 236 bytes. We can
1090 do ludicrously large NetROM frames but must not overflow */
1091 if (len > 65536)
1092 return -EMSGSIZE;
1093
1090 SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n"); 1094 SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
1091 size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN; 1095 size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
1092 1096