Skip to content
Snippets Groups Projects
Commit 5547b005 authored by Andrew Chant's avatar Andrew Chant
Browse files

Merge additional July 2017 security update.

Merge 'android-msm-angler-3.10-nyc-mr2-security-next'
to pick up missed patches.

July 2017.1

Bug: 38138153
parents bd52f078 c0afb15f
Branches
Tags android-7.1.2_r0.24
No related merge requests found
...@@ -3178,6 +3178,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv ...@@ -3178,6 +3178,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
return -EBUSY; return -EBUSY;
if (copy_from_user(&val, optval, sizeof(val))) if (copy_from_user(&val, optval, sizeof(val)))
return -EFAULT; return -EFAULT;
if (val > INT_MAX)
return -EINVAL;
po->tp_reserve = val; po->tp_reserve = val;
return 0; return 0;
} }
...@@ -3675,6 +3677,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, ...@@ -3675,6 +3677,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
rb->frames_per_block = req->tp_block_size/req->tp_frame_size; rb->frames_per_block = req->tp_block_size/req->tp_frame_size;
if (unlikely(rb->frames_per_block <= 0)) if (unlikely(rb->frames_per_block <= 0))
goto out; goto out;
if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
goto out;
if (unlikely((rb->frames_per_block * req->tp_block_nr) != if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
req->tp_frame_nr)) req->tp_frame_nr))
goto out; goto out;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment