git://ftp.safe.ca
/
safe
/
jmp
/
linux-2.6
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
| inline |
side by side
net: ipmr/ip6mr: fix potential out-of-bounds vif_table access
[safe/jmp/linux-2.6]
/
net
/
ipv6
/
ip6mr.c
diff --git
a/net/ipv6/ip6mr.c
b/net/ipv6/ip6mr.c
index
52e0f74
..
23e4ac0
100644
(file)
--- a/
net/ipv6/ip6mr.c
+++ b/
net/ipv6/ip6mr.c
@@
-1113,6
+1113,9
@@
static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
unsigned char ttls[MAXMIFS];
int i;
+ if (mfc->mf6cc_parent >= MAXMIFS)
+ return -ENFILE;
+
memset(ttls, 255, MAXMIFS);
for (i = 0; i < MAXMIFS; i++) {
if (IF_ISSET(i, &mfc->mf6cc_ifset))