TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[IPV6]: Handle np->opt being NULL in ipv6_getsockopt_sticky(). (CVE-2007-1000)

Browse Source 
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
This commit is contained in:
David S. Miller
2007-03-09 07:15:40 +01:00
committed by Adrian Bunk
parent e62a305abf
commit 5edf0f4dfb
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/ipv6/ipv6_sockglue.c
+7 -3
View File
@@ -631,11 +631,15 @@ e_inval:
return -EINVAL;
}
static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
char __user *optval, int len)
{
if (!hdr)
struct ipv6_opt_hdr *hdr;
if (!opt || !opt->hopopt)
return 0;
hdr = opt->hopopt;
len = min_t(int, len, ipv6_optlen(hdr));
if (copy_to_user(optval, hdr, ipv6_optlen(hdr)))
return -EFAULT;
@@ -779,7 +783,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
{
lock_sock(sk);
len = ipv6_getsockopt_sticky(sk, np->opt->hopopt,
len = ipv6_getsockopt_sticky(sk, np->opt,
optval, len);
release_sock(sk);
return put_user(len, optlen);