| commit | 381763428bf77c65ffaae67c2189eb87f7129ef4 | [log] [tgz] |
|---|---|---|
| author | Paul Stewart <pstew@google.com> | Thu Feb 02 12:02:47 2017 -0800 |
| committer | gitbuildkicker <android-build@google.com> | Tue Feb 21 16:13:26 2017 -0800 |
| tree | d2c82636a75931284584c0ccb77b6284f096d3c1 | |
| parent | ef6f663d4c9d3f399226da8aa75f0081a965874d [diff] |
Perform range check on len in nlmsg_reserve Bug: 32342065 Test: Compile Change-Id: I2ef3d63f0910120721c1448eb7d4d64bcec71009 (cherry picked from commit 438fe14af8e839a9186ba30cddbe81ad2311ed00)
diff --git a/lib/msg.c b/lib/msg.c index 9fe9d54..91b86cb 100644 --- a/lib/msg.c +++ b/lib/msg.c
@@ -518,6 +518,9 @@ size_t nlmsg_len = n->nm_nlh->nlmsg_len; size_t tlen; + if (len > n->nm_size) + return NULL; + tlen = pad ? ((len + (pad - 1)) & ~(pad - 1)) : len; if ((tlen + nlmsg_len) > n->nm_size)