Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts: drivers/net/smc911x.c
This commit is contained in:
@ -232,6 +232,11 @@ static unsigned char asn1_length_decode(struct asn1_ctx *ctx,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* don't trust len bigger than ctx buffer */
|
||||
if (*len > ctx->end - ctx->pointer)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
@ -250,6 +255,10 @@ static unsigned char asn1_header_decode(struct asn1_ctx *ctx,
|
||||
if (!asn1_length_decode(ctx, &def, &len))
|
||||
return 0;
|
||||
|
||||
/* primitive shall be definite, indefinite shall be constructed */
|
||||
if (*con == ASN1_PRI && !def)
|
||||
return 0;
|
||||
|
||||
if (def)
|
||||
*eoc = ctx->pointer + len;
|
||||
else
|
||||
@ -434,6 +443,11 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
|
||||
unsigned long *optr;
|
||||
|
||||
size = eoc - ctx->pointer + 1;
|
||||
|
||||
/* first subid actually encodes first two subids */
|
||||
if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
|
||||
return 0;
|
||||
|
||||
*oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
|
||||
if (*oid == NULL) {
|
||||
if (net_ratelimit())
|
||||
|
Reference in New Issue
Block a user