commit | f83d9c1c67b6be69a96995e384f50b572b667df0 | [log] [tgz] |
---|---|---|
author | Paul Stewart <pstew@google.com> | Thu Feb 02 12:02:47 2017 -0800 |
committer | Paul Stewart <pstew@google.com> | Wed Feb 08 11:29:16 2017 -0800 |
tree | 5f6397a485df7334ccd21b4a0a66e2b903a94686 | |
parent | f01b03b81ab86d2b4c0f874a438ff672d9fcc191 [diff] |
Perform range check on len in nlmsg_reserve Bug: 32342065 Test: Compile Change-Id: I2ef3d63f0910120721c1448eb7d4d64bcec71009
diff --git a/lib/msg.c b/lib/msg.c index 9fe9d54..91b86cb 100644 --- a/lib/msg.c +++ b/lib/msg.c
@@ -518,6 +518,9 @@ size_t nlmsg_len = n->nm_nlh->nlmsg_len; size_t tlen; + if (len > n->nm_size) + return NULL; + tlen = pad ? ((len + (pad - 1)) & ~(pad - 1)) : len; if ((tlen + nlmsg_len) > n->nm_size)