From: Eric Dumazet <edumazet@google.com>
Date: Sun, 25 Nov 2012 09:44:29 +0000 (+0000)
Subject: net: ipmr: limit MRT_TABLE identifiers
X-Git-Tag: v3.7-rc8~24^2~11
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b49d3c1e1c948d76d64790abe9acffa9fa747d19;p=pandora-kernel.git

net: ipmr: limit MRT_TABLE identifiers

Name of pimreg devices are built from following format :

char name[IFNAMSIZ]; // IFNAMSIZ == 16

sprintf(name, "pimreg%u", mrt->id);

We must therefore limit mrt->id to 9 decimal digits
or risk a buffer overflow and a crash.

Restrict table identifiers in [0 ... 999999999] interval.

Reported-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed