| commit | fb8585fc3f9b39153e0bdaf03f00a02dde9c03c6 | |
| author | Roel Kluin <roel.kluin@gmail.com> | |
| Tue, 24 Mar 2009 03:27:48 +0000 (24 03:27 +0000) | ||
| committer | David S. Miller <davem@davemloft.net> | |
| Tue, 24 Mar 2009 22:24:30 +0000 (24 15:24 -0700) | ||
| tree | 7097afe2b7adc07f38457549a1e89701153ecae9 | treesnapshot (tar.gz zip) |
| parent | 3a05d1404d91efd63f0654a4bf59b8803c32efdd | commitdiff |
ctcm: avoid wraparound in length of incoming data
Since the receive code should tolerate any incoming garbage, it
should be protected against a potential wraparound when manipulating
length values within incoming data.
block_len is unsigned, so a too large subtraction will cause a
wraparound.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Since the receive code should tolerate any incoming garbage, it
should be protected against a potential wraparound when manipulating
length values within incoming data.
block_len is unsigned, so a too large subtraction will cause a
wraparound.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| drivers/s390/net/ctcm_fsms.c | diffblobblamehistory | |
| drivers/s390/net/ctcm_main.c | diffblobblamehistory |