diff options
author | Paul Mackerras <paulus@samba.org> | 2008-06-30 10:16:50 +1000 |
---|---|---|
committer | Paul Mackerras <paulus@samba.org> | 2008-06-30 10:16:50 +1000 |
commit | e9a4b6a3f6592862a67837e80aad3f50468857a6 (patch) | |
tree | 087420cf91ac922c7e99757c4490a605ec7b10f2 /net/sctp/socket.c | |
parent | 441dbb500b4344a8e3125e5aabab4f9dbf72514f (diff) | |
parent | 1702b52092e9a6d05398d3f9581ddc050ef00d06 (diff) |
Merge branch 'linux-2.6'
Diffstat (limited to 'net/sctp/socket.c')
-rw-r--r-- | net/sctp/socket.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index e7e3baf7009e..0dbcde6758ea 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -4401,7 +4401,9 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len, if (copy_from_user(&getaddrs, optval, len)) return -EFAULT; - if (getaddrs.addr_num <= 0) return -EINVAL; + if (getaddrs.addr_num <= 0 || + getaddrs.addr_num >= (INT_MAX / sizeof(union sctp_addr))) + return -EINVAL; /* * For UDP-style sockets, id specifies the association to query. * If the id field is set to the value '0' then the locally bound |