We recently added some bounds checking in ax25_connect() and ax25_sendmsg() and we so we removed the AX25_MAX_DIGIS checks because they were no longer required. Unfortunately, I believe they are required to prevent integer overflows so I have added them back.
Unified · Split
| @@ -1188,6 +1188,7 @@ static int __must_check ax25_connect(struct socket *sock, · 1187 unmodified lines | |||
| 1188 | fsa->fsa_ax25.sax25_ndigis != 0) { | 1188 | fsa->fsa_ax25.sax25_ndigis != 0) { |
| 1189 | /* Valid number of digipeaters ? */ | 1189 | /* Valid number of digipeaters ? */ |
| 1190 | if (fsa->fsa_ax25.sax25_ndigis < 1 || | 1190 | if (fsa->fsa_ax25.sax25_ndigis < 1 || |
| 1191 | fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS || | ||
| 1191 | addr_len < sizeof(struct sockaddr_ax25) + | 1192 | addr_len < sizeof(struct sockaddr_ax25) + |
| 1192 | sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) { | 1193 | sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) { |
| 1193 | err = -EINVAL; | 1194 | err = -EINVAL; |
| @@ -1509,7 +1510,9 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) · 315 unmodified lines | |||
| 1509 | struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax; | 1510 | struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax; |
| 1510 | 1511 | ||
| 1511 | /* Valid number of digipeaters ? */ | 1512 | /* Valid number of digipeaters ? */ |
| 1512 | if (usax->sax25_ndigis < 1 || addr_len < sizeof(struct sockaddr_ax25) + | 1513 | if (usax->sax25_ndigis < 1 || |
| 1514 | usax->sax25_ndigis > AX25_MAX_DIGIS || | ||
| 1515 | addr_len < sizeof(struct sockaddr_ax25) + | ||
| 1513 | sizeof(ax25_address) * usax->sax25_ndigis) { | 1516 | sizeof(ax25_address) * usax->sax25_ndigis) { |
| 1514 | err = -EINVAL; | 1517 | err = -EINVAL; |
| 1515 | goto out; | 1518 | goto out; |