X-Git-Url: https://git.karo-electronics.de/?a=blobdiff_plain;f=net%2Fsctp%2Fsocket.c;h=5ffb9dec1c3f17526a5c4474e086a2cd04c2a588;hb=616ad8c44281c0c6711a72b560e01ec335ff27e0;hp=afa952e726d7c9ab8b2c8951d5ffdcd87fe47aca;hpb=3d87ff3e44bd2a13cbe2d2e02cc5e38953ff260f;p=mv-sheeva.git

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index afa952e726d..5ffb9dec1c3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3086,6 +3086,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
 				    int optlen)
 {
 	struct sctp_hmacalgo *hmacs;
+	u32 idents;
 	int err;
 
 	if (!sctp_auth_enable)
@@ -3103,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
 		goto out;
 	}
 
-	if (hmacs->shmac_num_idents == 0 ||
-	    hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) {
+	idents = hmacs->shmac_num_idents;
+	if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
+	    (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
 		err = -EINVAL;
 		goto out;
 	}
@@ -3144,7 +3146,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
 		goto out;
 	}
 
-	if (authkey->sca_keylength > optlen) {
+	if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
 		ret = -EINVAL;
 		goto out;
 	}