Tag: ddb3712552c8807c75576fb4fbdbb16f0d48b161

tipc: safely copy UDP netlink data from user

Author: Richard Alpe <richard.alpe@ericsson.com> The netlink policy for TIPC_NLA_UDP_LOCAL and TIPC_NLA_UDP_REMOTE is of type binary with a defined length. This causes the policy framework to threat the defined length as maximum length. There is however no protection against a user sending a smaller amount of data. Prior to this patch this wasn’t handled which could …

Continue reading