diff options
| author | David S. Miller <davem@davemloft.net> | 2015-12-15 15:39:08 -0500 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2016-01-05 18:18:01 +0100 |
| commit | 1d9e57809a93e4083d2b898126ed2165f5200d60 (patch) | |
| tree | 60aa904b41e19822724e9abe4e05de540c07fef2 | |
| parent | d470ffbe3fe914d176ced4cf330a297c523c5711 (diff) | |
| download | linux-1d9e57809a93e4083d2b898126ed2165f5200d60.tar.gz linux-1d9e57809a93e4083d2b898126ed2165f5200d60.tar.bz2 linux-1d9e57809a93e4083d2b898126ed2165f5200d60.zip | |
bluetooth: Validate socket address length in sco_sock_bind().
[ Upstream commit 5233252fce714053f0151680933571a2da9cbfb4 ]
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
| -rw-r--r-- | net/bluetooth/sco.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 4f5f01b779b5..6bfdd333f0d5 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -463,6 +463,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le if (!addr || addr->sa_family != AF_BLUETOOTH) return -EINVAL; + if (addr_len < sizeof(struct sockaddr_sco)) + return -EINVAL; + lock_sock(sk); if (sk->sk_state != BT_OPEN) { |