Tree - rpms/kernel - src.fedoraproject.org

Blob History Raw

		44ce161	`From 5233252fce714053f0151680933571a2da9cbfb4 Mon Sep 17 00:00:00 2001`
		44ce161	`From: "David S. Miller" <davem@davemloft.net>`
		44ce161	`Date: Tue, 15 Dec 2015 15:39:08 -0500`
		44ce161	`Subject: [PATCH] bluetooth: Validate socket address length in sco_sock_bind().`
		44ce161
		44ce161	`Signed-off-by: David S. Miller <davem@davemloft.net>`
		44ce161	`---`
		44ce161	`net/bluetooth/sco.c \| 3 +++`
		44ce161	`1 file changed, 3 insertions(+)`
		44ce161
		44ce161	`diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c`
		44ce161	`index fe129663bd3f..f52bcbf2e58c 100644`
		44ce161	`--- a/net/bluetooth/sco.c`
		44ce161	`+++ b/net/bluetooth/sco.c`
		44ce161	`@@ -526,6 +526,9 @@ static int sco_sock_bind(struct socket sock, struct sockaddr addr,`
		44ce161	`if (!addr \|\| addr->sa_family != AF_BLUETOOTH)`
		44ce161	`return -EINVAL;`
		44ce161
		44ce161	`+ if (addr_len < sizeof(struct sockaddr_sco))`
		44ce161	`+ return -EINVAL;`
		44ce161	`+`
		44ce161	`lock_sock(sk);`
		44ce161
		44ce161	`if (sk->sk_state != BT_OPEN) {`
		44ce161	`--`
		44ce161	`2.5.0`
		44ce161