af_rose/x25: Sanity check the maximum user frame size

Otherwise we can wrap the sizes and end up sending garbage. Closes #10423 Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>

af_rose/x25: Sanity check the maximum user frame size
Otherwise we can wrap the sizes and end up sending garbage. Closes #10423 Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
Alan Cox · David S. Miller
1 parent 03ba999117
Showing 3 changed files with 15 additions and 1 deletions Side-by-side Diff
net/netrom/af_netrom.c
net/rose/af_rose.c
net/x25/af_x25.c
@@ -1086,7 +1086,11 @@
  
 	SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
  
-	/* Build a packet */
+	/* Build a packet - the conventional user limit is 236 bytes. We can
+	   do ludicrously large NetROM frames but must not overflow */
+	if (len > 65536)
+		return -EMSGSIZE;
+
 	SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
 	size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
  
@@ -1124,6 +1124,10 @@
  
 	/* Build a packet */
 	SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
+	/* Sanity check the packet size */
+	if (len > 65535)
+		return -EMSGSIZE;
+
 	size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
  
 	if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
@@ -1035,6 +1035,12 @@
 		sx25.sx25_addr   = x25->dest_addr;
 	}
  
+	/* Sanity check the packet size */
+	if (len > 65535) {
+		rc = -EMSGSIZE;
+		goto out;
+	}
+
 	SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
  
 	/* Build a packet */
...	...	@@ -1086,7 +1086,11 @@
1086	1086
1087	1087	SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
1088	1088
1089		- /* Build a packet */
	1089	+ /* Build a packet - the conventional user limit is 236 bytes. We can
	1090	+ do ludicrously large NetROM frames but must not overflow */
	1091	+ if (len > 65536)
	1092	+ return -EMSGSIZE;
	1093	+
1090	1094	SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
1091	1095	size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
1092	1096
...	...	@@ -1124,6 +1124,10 @@
1124	1124
1125	1125	/* Build a packet */
1126	1126	SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
	1127	+ /* Sanity check the packet size */
	1128	+ if (len > 65535)
	1129	+ return -EMSGSIZE;
	1130	+
1127	1131	size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
1128	1132
1129	1133	if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
...	...	@@ -1035,6 +1035,12 @@
1035	1035	sx25.sx25_addr = x25->dest_addr;
1036	1036	}
1037	1037
	1038	+ /* Sanity check the packet size */
	1039	+ if (len > 65535) {
	1040	+ rc = -EMSGSIZE;
	1041	+ goto out;
	1042	+ }
	1043	+
1038	1044	SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
1039	1045
1040	1046	/* Build a packet */