diff options
| author | Tomasz Grobelny <tomasz@grobelny.oswiecenia.net> | 2010-12-04 13:39:13 +0100 |
|---|---|---|
| committer | Gerrit Renker <gerrit@erg.abdn.ac.uk> | 2010-12-07 13:47:12 +0100 |
| commit | 04910265078f08a73208beab70ed2a3cce4a919f (patch) | |
| tree | cc7e1c927ceda1ddf5f86d50f8ee22a1a4e32fe6 /net/dccp/proto.c | |
| parent | 871a2c16c21b988688b4ab1a78eadd969765c0a3 (diff) | |
dccp qpolicy: Parameter checking of cmsg qpolicy parameters
Ensure that cmsg->cmsg_type value is valid for qpolicy
that is currently in use.
Signed-off-by: Tomasz Grobelny <tomasz@grobelny.oswiecenia.net>
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Diffstat (limited to 'net/dccp/proto.c')
| -rw-r--r-- | net/dccp/proto.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/dccp/proto.c b/net/dccp/proto.c index d6a224982bb5..152975d942d9 100644 --- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@ -726,6 +726,10 @@ static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb) if (cmsg->cmsg_level != SOL_DCCP) continue; + if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX && + !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type)) + return -EINVAL; + switch (cmsg->cmsg_type) { case DCCP_SCM_PRIORITY: if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32))) |