aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorPaul Moore <paul.moore@hp.com>2007-01-05 15:08:22 -0500
committerDavid S. Miller <davem@sunset.davemloft.net>2007-01-09 03:30:01 -0500
commit2a2f11c227bdf292b3a2900ad04139d301b56ac4 (patch)
treee94ced56b21fa9258dc6d8c9d8b1e1a3f6e190a1 /net
parent797951200679f1d5ea12a2e58cc7bdbc2848764c (diff)
NetLabel: correct CIPSO tag handling when adding new DOI definitions
The current netlbl_cipsov4_add_common() function has two problems which are fixed with this patch. The first is an off-by-one bug where it is possibile to overflow the doi_def->tags[] array. The second is a bug where the same doi_def->tags[] array was not always fully initialized, which caused sporadic failures. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'net')
-rw-r--r--net/netlabel/netlabel_cipso_v4.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 4afc75f9e377..73e0ff469bff 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -130,12 +130,12 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,
130 130
131 nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem) 131 nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
132 if (nla->nla_type == NLBL_CIPSOV4_A_TAG) { 132 if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
133 if (iter > CIPSO_V4_TAG_MAXCNT) 133 if (iter >= CIPSO_V4_TAG_MAXCNT)
134 return -EINVAL; 134 return -EINVAL;
135 doi_def->tags[iter++] = nla_get_u8(nla); 135 doi_def->tags[iter++] = nla_get_u8(nla);
136 } 136 }
137 if (iter < CIPSO_V4_TAG_MAXCNT) 137 while (iter < CIPSO_V4_TAG_MAXCNT)
138 doi_def->tags[iter] = CIPSO_V4_TAG_INVALID; 138 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
139 139
140 return 0; 140 return 0;
141} 141}