x25: Validate incoming call user data lengths

[karo-tx-linux.git] / net / x25 / af_x25.c

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index d30615419b4d77c1c375302f28c64034144b9385..a4bd1720e39b9047fa59612064de8e3a054dc6a4 100644 (file)
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -958,6 +958,12 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
                goto out_clear_request;
        skb_pull(skb,len);
 
+       /*
+        *      Ensure that the amount of call user data is valid.
+        */
+       if (skb->len > X25_MAX_CUD_LEN)
+               goto out_clear_request;
+
        /*
         *      Find a listener for the particular address/cud pair.
         */