2 files changed, 9 insertions, 0 deletions

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index d30615419b4d..a4bd1720e39b 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -959,6 +959,12 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         skb_pull(skb,len);
 
         /*
+         *      Ensure that the amount of call user data is valid.
+         */
+        if (skb->len > X25_MAX_CUD_LEN)
+                goto out_clear_request;
+
+        /*
          *      Find a listener for the particular address/cud pair.
          */
         sk = x25_find_listener(&source_addr,skb);
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 0b073b51b183..63488fd4885a 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -127,6 +127,9 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                  *      Copy any Call User Data.
                  */
                 if (skb->len > 0) {
+                        if (skb->len > X25_MAX_CUD_LEN)
+                                goto out_clear;
+
                         skb_copy_from_linear_data(skb,
                                                   x25->calluserdata.cuddata,
                                                   skb->len);