diff options
| author | John Stultz <john.stultz@linaro.org> | 2011-10-26 13:48:49 -0700 |
|---|---|---|
| committer | John Stultz <john.stultz@linaro.org> | 2011-10-26 13:48:49 -0700 |
| commit | 2216773fc021964a413409141d439de4f6a108f7 (patch) | |
| tree | 7b2f8cdcdf5fb05d75bd92f0c8d9ac635ceec48c /net/x25/x25_subr.c | |
| parent | 42ac8ca89aef66618e8ae2d6e48e3f523bfcd69d (diff) | |
| parent | af1bdb79ca64ceadc7b44b11929b384eff66ce59 (diff) | |
Merge branch 'upstream/linaro-3.1' into linaro-android-3.1-agreen-rebaselinux-linaro-3.1-2011.10-2-android-0
Diffstat (limited to 'net/x25/x25_subr.c')
| -rw-r--r-- | net/x25/x25_subr.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c index 24a342ebc7f..5170d52bfd9 100644 --- a/net/x25/x25_subr.c +++ b/net/x25/x25_subr.c @@ -269,7 +269,11 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q, int *d, int *m) { struct x25_sock *x25 = x25_sk(sk); - unsigned char *frame = skb->data; + unsigned char *frame; + + if (!pskb_may_pull(skb, X25_STD_MIN_LEN)) + return X25_ILLEGAL; + frame = skb->data; *ns = *nr = *q = *d = *m = 0; @@ -294,6 +298,10 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q, if (frame[2] == X25_RR || frame[2] == X25_RNR || frame[2] == X25_REJ) { + if (!pskb_may_pull(skb, X25_EXT_MIN_LEN)) + return X25_ILLEGAL; + frame = skb->data; + *nr = (frame[3] >> 1) & 0x7F; return frame[2]; } @@ -308,6 +316,10 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q, if (x25->neighbour->extended) { if ((frame[2] & 0x01) == X25_DATA) { + if (!pskb_may_pull(skb, X25_EXT_MIN_LEN)) + return X25_ILLEGAL; + frame = skb->data; + *q = (frame[0] & X25_Q_BIT) == X25_Q_BIT; *d = (frame[0] & X25_D_BIT) == X25_D_BIT; *m = (frame[3] & X25_EXT_M_BIT) == X25_EXT_M_BIT; |