commit | 07561d90797ff85c8775aca4b1edeea160c5db55 | [log] [tgz] |
---|---|---|
author | Paul Stewart <pstew@google.com> | Thu Feb 02 12:02:47 2017 -0800 |
committer | gitbuildkicker <android-build@google.com> | Wed Feb 22 15:09:20 2017 -0800 |
tree | d2c82636a75931284584c0ccb77b6284f096d3c1 | |
parent | 7dd2dbda2a4029f8b7334c0029ca04c4a00c6bbf [diff] |
Perform range check on len in nlmsg_reserve Bug: 32342065 Test: Compile Change-Id: I2ef3d63f0910120721c1448eb7d4d64bcec71009 (cherry picked from commit 438fe14af8e839a9186ba30cddbe81ad2311ed00)
diff --git a/lib/msg.c b/lib/msg.c index 9fe9d54..91b86cb 100644 --- a/lib/msg.c +++ b/lib/msg.c
@@ -518,6 +518,9 @@ size_t nlmsg_len = n->nm_nlh->nlmsg_len; size_t tlen; + if (len > n->nm_size) + return NULL; + tlen = pad ? ((len + (pad - 1)) & ~(pad - 1)) : len; if ((tlen + nlmsg_len) > n->nm_size)