diff options
| author | Kees Cook <keescook@chromium.org> | 2018-02-15 02:45:07 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-05-30 08:48:59 +0300 |
| commit | 50e54d56744cda70a1c3bc980c56e461ecde3a6d (patch) | |
| tree | 337004b23cd98fd146c6e63bcfc4337279fec2e5 /net/nfc/netlink.c | |
| parent | 591515bb2ad390dad3b1b090f5d2e687006a5c02 (diff) | |
| download | linux-50e54d56744cda70a1c3bc980c56e461ecde3a6d.tar.xz | |
NFC: llcp: Limit size of SDP URI
[ Upstream commit fe9c842695e26d8116b61b80bfb905356f07834b ]
The tlv_len is u8, so we need to limit the size of the SDP URI. Enforce
this both in the NLA policy and in the code that performs the allocation
and copy, to avoid writing past the end of the allocated buffer.
Fixes: d9b8d8e19b073 ("NFC: llcp: Service Name Lookup netlink interface")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/nfc/netlink.c')
| -rw-r--r-- | net/nfc/netlink.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c index 12dfb457275d..32cb0c87e852 100644 --- a/net/nfc/netlink.c +++ b/net/nfc/netlink.c @@ -68,7 +68,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = { }; static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = { - [NFC_SDP_ATTR_URI] = { .type = NLA_STRING }, + [NFC_SDP_ATTR_URI] = { .type = NLA_STRING, + .len = U8_MAX - 4 }, [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 }, }; |