commit 170a7d24f4421dfaf92064e571b38f805f590e6e
author Paul Stewart <pstew@google.com> Fri Feb 10 00:04:16 2017 +0000
committer android-build-merger <android-build-merger@google.com> Fri Feb 10 00:04:16 2017 +0000
tree d2c82636a75931284584c0ccb77b6284f096d3c1
parent c9e7458d7658809551e93c01f9374046d5e51a31
parent 642a497f9c8de5aa9a938edc1f10e5407617860f

Perform range check on len in nlmsg_reserve am: f83d9c1c67 am: d42374324d am: d9f824b744 am: 25edb109fc am: b0a4ed4800 am: 65d4de583a am: 45c4ce4768
am: 642a497f9c

Change-Id: I26dfbb4b58a9d34be0df2d953b939e3ce7ca89b4

lib/msg.c

diff --git a/lib/msg.c b/lib/msg.c
index 9fe9d54..91b86cb 100644
--- a/lib/msg.c
+++ b/lib/msg.c
@@ -518,6 +518,9 @@
 	size_t nlmsg_len = n->nm_nlh->nlmsg_len;
 	size_t tlen;
 
+	if (len > n->nm_size)
+		return NULL;
+
 	tlen = pad ? ((len + (pad - 1)) & ~(pad - 1)) : len;
 
 	if ((tlen + nlmsg_len) > n->nm_size)