tree c21d9c1c7f2792b0889432988d42e9b90f953358
parent e68e6133e2daef6fc40e91621a1e26938e428e9e
author Dan Rosenberg <drosenberg@vsecurity.com> 1289594682 -0800
committer David S. Miller <davem@davemloft.net> 1289594682 -0800

x25: Prevent crashing when parsing bad X.25 facilities

Now with improved comma support.

On parsing malformed X.25 facilities, decrementing the remaining length
may cause it to underflow.  Since the length is an unsigned integer,
this will result in the loop continuing until the kernel crashes.

This patch adds checks to ensure decrementing the remaining length does
not cause it to wrap around.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>