diff options
| author | Ahmed S. Darwish <[email protected]> | 2008-03-13 19:32:34 +0000 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2008-03-13 20:11:43 +0000 |
| commit | b500ce8d24d1f14426643da5f6fada28c1f60533 (patch) | |
| tree | 17b6084b29434a968f787e238548a843126e2ec3 /scripts/mod/file2alias.c | |
| parent | Merge master.kernel.org:/home/rmk/linux-2.6-arm (diff) | |
| download | kernel-b500ce8d24d1f14426643da5f6fada28c1f60533.tar.gz kernel-b500ce8d24d1f14426643da5f6fada28c1f60533.zip | |
smackfs: do not trust `count' in inodes write()s
Smackfs write() implementation does not put a higher bound on the number of
bytes to copy from user-space. This may lead to a DOS attack if a malicious
`count' field is given.
Assure that given `count' is exactly the length needed for a /smack/load rule.
In case of /smack/cipso where the length is relative, assure that `count'
does not exceed the size needed for a buffer representing maximum possible
number of CIPSO 2.2 categories.
Signed-off-by: Ahmed S. Darwish <[email protected]>
Acked-by: Casey Schaufler <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'scripts/mod/file2alias.c')
0 files changed, 0 insertions, 0 deletions