Dan Rosenberg 73c9362424 x25: Prevent crashing when parsing bad X.25 facilities ... commit 5ef41308f9 upstream. Now with improved comma support. On parsing malformed X.25 facilities, decrementing the remaining length may cause it to underflow. Since the length is an unsigned integer, this will result in the loop continuing until the kernel crashes. This patch adds checks to ensure decrementing the remaining length does not cause it to wrap around. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>		2010-12-09 13:27:10 -08:00
..
af_x25.c	x25: Patch to fix bug 15678 - x25 accesses fields beyond end of packet.	2010-12-09 13:27:09 -08:00
Kconfig
Makefile
sysctl_net_x25.c	net: '&' redux	2008-11-03 18:21:05 -08:00
x25_dev.c	netns: Use net_eq() to compare net-namespaces for optimization.	2008-07-19 22:34:43 -07:00
x25_facilities.c	x25: Prevent crashing when parsing bad X.25 facilities	2010-12-09 13:27:10 -08:00
x25_forward.c	[X25]: use LIST_HEAD instead of LIST_HEAD_INIT	2008-01-28 14:56:53 -08:00
x25_in.c	memory corruption in X.25 facilities parsing	2010-12-09 13:27:09 -08:00
x25_link.c	[X25]: use LIST_HEAD instead of LIST_HEAD_INIT	2008-01-28 14:56:53 -08:00
x25_out.c	[SK_BUFF]: Introduce skb_copy_to_linear_data{_offset}	2007-04-25 22:28:29 -07:00
x25_proc.c	net: correct off-by-one write allocations reports	2009-06-18 00:29:12 -07:00
x25_route.c	[X25]: use LIST_HEAD instead of LIST_HEAD_INIT	2008-01-28 14:56:53 -08:00
x25_subr.c	[X25]: Avoid divides and sparse warnings	2008-01-28 15:02:03 -08:00
x25_timer.c	x25: Fix sleep from timer on socket destroy.	2009-06-16 05:40:30 -07:00