git://ftp.safe.ca
/
safe
/
jmp
/
linux-2.6
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
| inline |
side by side
sctp: fix random memory dereference with SCTP_HMAC_IDENT option.
[safe/jmp/linux-2.6]
/
net
/
sctp
/
auth.c
diff --git
a/net/sctp/auth.c
b/net/sctp/auth.c
index
1fcb4cf
..
52db5f6
100644
(file)
--- a/
net/sctp/auth.c
+++ b/
net/sctp/auth.c
@@
-786,6
+786,9
@@
int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
for (i = 0; i < hmacs->shmac_num_idents; i++) {
id = hmacs->shmac_idents[i];
+ if (id > SCTP_AUTH_HMAC_ID_MAX)
+ return -EOPNOTSUPP;
+
if (SCTP_AUTH_HMAC_ID_SHA1 == id)
has_sha1 = 1;