diff options
Diffstat (limited to 'sys-kernel/cairn-sources/files/5.10.8/hardened-patches/0068-sanity-check-for-negative-length-in-nla_memcpy.patch')
| -rw-r--r-- | sys-kernel/cairn-sources/files/5.10.8/hardened-patches/0068-sanity-check-for-negative-length-in-nla_memcpy.patch | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/sys-kernel/cairn-sources/files/5.10.8/hardened-patches/0068-sanity-check-for-negative-length-in-nla_memcpy.patch b/sys-kernel/cairn-sources/files/5.10.8/hardened-patches/0068-sanity-check-for-negative-length-in-nla_memcpy.patch new file mode 100644 index 000000000000..557c46098f89 --- /dev/null +++ b/sys-kernel/cairn-sources/files/5.10.8/hardened-patches/0068-sanity-check-for-negative-length-in-nla_memcpy.patch @@ -0,0 +1,28 @@ +From 6b8bf6e5b343b553cb8caa6dffa2aad3572c8aec Mon Sep 17 00:00:00 2001 +From: Daniel Micay <danielmicay@gmail.com> +Date: Mon, 15 May 2017 23:51:12 -0400 +Subject: [PATCH 068/113] sanity check for negative length in nla_memcpy + +Extracted from PaX. + +Signed-off-by: Daniel Micay <danielmicay@gmail.com> +--- + lib/nlattr.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/nlattr.c b/lib/nlattr.c +index 74019c8ebf6b..c480b4e7ffef 100644 +--- a/lib/nlattr.c ++++ b/lib/nlattr.c +@@ -778,6 +778,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count) + { + int minlen = min_t(int, count, nla_len(src)); + ++ BUG_ON(minlen < 0); ++ + memcpy(dest, nla_data(src), minlen); + if (count > minlen) + memset(dest + minlen, 0, count - minlen); +-- +2.30.0 + |