1 Oct 2009 03:59
sit: fix off-by-one in ipip6_tunnel_get_prl
Linux Kernel Mailing List <linux-kernel <at> vger.kernel.org>
2009-10-01 01:59:04 GMT
2009-10-01 01:59:04 GMT
Gitweb: http://git.kernel.org/linus/298bf12ddb25841804f26234a43b89da1b1c0e21 Commit: 298bf12ddb25841804f26234a43b89da1b1c0e21 Parent: d99927f4d93f36553699573b279e0ff98ad7dea6 Author: Sascha Hlusiak <contact <at> saschahlusiak.de> AuthorDate: Tue Sep 29 11:27:05 2009 +0000 Committer: David S. Miller <davem <at> davemloft.net> CommitDate: Wed Sep 30 16:39:27 2009 -0700 sit: fix off-by-one in ipip6_tunnel_get_prl When requesting all prl entries (kprl.addr == INADDR_ANY) and there are more prl entries than there is space passed from userspace, the existing code would always copy cmax+1 entries, which is more than can be handled. This patch makes the kernel copy only exactly cmax entries. Signed-off-by: Sascha Hlusiak <contact <at> saschahlusiak.de> Acked-By: Fred L. Templin <Fred.L.Templin <at> boeing.com> Signed-off-by: David S. Miller <davem <at> davemloft.net> --- net/ipv6/sit.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index d65e0c4..dbd19a7 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c <at> <at> -274,7 +274,7 <at> <at> static int ipip6_tunnel_get_prl(struct ip_tunnel *t, c = 0;(Continue reading)
RSS Feed