diff options
| author | Ralf Baechle <ralf@linux-mips.org> | 1998-09-19 19:15:08 +0000 |
|---|---|---|
| committer | Ralf Baechle <ralf@linux-mips.org> | 1998-09-19 19:15:08 +0000 |
| commit | 03ba4131783cc9e872f8bb26a03f15bc11f27564 (patch) | |
| tree | 88db8dba75ae06ba3bad08e42c5e52efc162535c /net/core/scm.c | |
| parent | 257730f99381dd26e10b832fce4c94cae7ac1176 (diff) | |
- Merge with Linux 2.1.121.
- Bugfixes.
Diffstat (limited to 'net/core/scm.c')
| -rw-r--r-- | net/core/scm.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/core/scm.c b/net/core/scm.c index 3e4469f29..e16c4a45f 100644 --- a/net/core/scm.c +++ b/net/core/scm.c @@ -138,11 +138,15 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p) for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) { + err = -EINVAL; + + if ((unsigned long)(((char*)cmsg - (char*)msg->msg_control) + + cmsg->cmsg_len) > msg->msg_controllen) + goto error; + if (cmsg->cmsg_level != SOL_SOCKET) continue; - err = -EINVAL; - switch (cmsg->cmsg_type) { case SCM_RIGHTS: |