git.openpandora.org
/
pandora-kernel.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
1e44aaf
)
bluetooth: Validate socket address length in sco_sock_bind().
author
David S. Miller
<davem@davemloft.net>
Tue, 15 Dec 2015 20:39:08 +0000
(15:39 -0500)
committer
Ben Hutchings
<ben@decadent.org.uk>
Wed, 30 Dec 2015 02:26:03 +0000
(
02:26
+0000)
[ Upstream commit
5233252fce714053f0151680933571a2da9cbfb4
]
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
net/bluetooth/sco.c
patch
|
blob
|
history
diff --git
a/net/bluetooth/sco.c
b/net/bluetooth/sco.c
index
2e80aee
..
9f0e5a4
100644
(file)
--- a/
net/bluetooth/sco.c
+++ b/
net/bluetooth/sco.c
@@
-475,6
+475,9
@@
static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
if (!addr || addr->sa_family != AF_BLUETOOTH)
return -EINVAL;
+ if (addr_len < sizeof(struct sockaddr_sco))
+ return -EINVAL;
+
lock_sock(sk);
if (sk->sk_state != BT_OPEN) {