We recently added some bounds checking in ax25_connect() and ax25_sendmsg() and we so we removed the AX25_MAX_DIGIS checks because they were no longer required. Unfortunately, I believe they are required to prevent integer overflows so I have added them back.
Unified · Split
| @@ -1188,6 +1188,7 @@ static int __must_check ax25_connect(struct socket *sock, · 1187 unmodified lines | ||
| 1188 | 1188 | fsa->fsa_ax25.sax25_ndigis != 0) { |
| 1189 | 1189 | /* Valid number of digipeaters ? */ |
| 1190 | 1190 | if (fsa->fsa_ax25.sax25_ndigis < 1 || |
| 1191 | + fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS || | |
| 1191 | 1192 | addr_len < sizeof(struct sockaddr_ax25) + |
| 1192 | 1193 | sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) { |
| 1193 | 1194 | err = -EINVAL; |
| @@ -1509,7 +1510,9 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) · 315 unmodified lines | ||
| 1509 | 1510 | struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax; |
| 1510 | 1511 | |
| 1511 | 1512 | /* Valid number of digipeaters ? */ |
| 1512 | − if (usax->sax25_ndigis < 1 || addr_len < sizeof(struct sockaddr_ax25) + | |
| 1513 | + if (usax->sax25_ndigis < 1 || | |
| 1514 | + usax->sax25_ndigis > AX25_MAX_DIGIS || | |
| 1515 | + addr_len < sizeof(struct sockaddr_ax25) + | |
| 1513 | 1516 | sizeof(ax25_address) * usax->sax25_ndigis) { |
| 1514 | 1517 | err = -EINVAL; |
| 1515 | 1518 | goto out; |