Sridhar Samudrala 28ea23d984
Fix sctp privilege elevation (CVE-2006-3745) ...
sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.
It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com >
Acked-by: David Miller <davem@davemloft.net >
Signed-off-by: Adrian Bunk <bunk@stusta.de >
2006-08-23 18:01:55 +02:00
2006-02-13 11:39:57 +01:00
2006-02-13 15:34:11 -08:00
2006-02-04 23:51:17 -08:00
2006-08-23 18:01:55 +02:00
2006-01-12 14:06:39 -08:00
2006-01-09 14:16:08 -08:00
2006-01-03 14:10:46 -08:00
2006-01-03 13:11:21 -08:00
2006-03-19 13:20:06 -08:00
2006-01-08 20:14:07 -08:00
2006-01-08 20:14:07 -08:00
2005-12-05 13:42:06 -08:00
2006-01-07 12:57:28 -08:00
2006-01-03 13:10:24 -08:00
2006-01-13 13:06:40 -08:00
2006-01-03 13:11:21 -08:00
2006-01-16 16:51:54 -05:00
2006-01-27 16:49:58 -05:00
2005-12-27 14:03:00 -08:00
2006-01-03 13:10:46 -08:00
2006-01-03 13:10:47 -08:00
2006-01-03 13:11:15 -08:00
2006-01-10 12:54:26 -08:00
2006-01-03 13:11:21 -08:00
2006-01-03 13:11:21 -08:00
2006-01-03 13:11:21 -08:00
2006-01-03 13:11:21 -08:00
2006-01-03 13:10:31 -08:00
2006-01-03 13:11:21 -08:00
2006-01-03 13:11:21 -08:00
2006-04-17 13:16:04 -07:00
2006-01-07 12:57:31 -08:00
2006-01-16 16:51:53 -05:00
2005-11-14 21:58:18 -08:00
2006-01-03 13:11:21 -08:00
2006-01-03 13:11:21 -08:00
2005-11-10 02:26:40 +01:00
2006-01-03 13:11:21 -08:00
2006-01-09 14:16:05 -08:00
2006-01-07 12:57:29 -08:00
2006-01-03 13:11:21 -08:00
2006-01-03 13:10:36 -08:00
2006-01-31 17:35:35 -08:00
2006-03-17 16:05:43 -08:00
2006-01-03 13:10:57 -08:00
2006-01-03 16:03:49 -08:00
2006-01-03 13:10:54 -08:00
2006-01-03 13:10:38 -08:00
2006-01-03 13:11:21 -08:00
2006-02-27 13:00:40 -08:00
Sridhar Samudrala
28ea23d984