~ubuntu-branches/ubuntu/maverick/linux-ti-omap4/maverick-proposed

« back to all changes in this revision

Viewing changes to net/bluetooth/l2cap.c

  • Committer: Package Import Robot
  • Author(s): Paolo Pisati, Ming Lei, Upstream Kernel Changes
  • Date: 2011-09-20 19:12:28 UTC
  • Revision ID: package-import@ubuntu.com-20110920191228-smig4in889luhu1y
Tags: 2.6.35-903.25
[ Ming Lei ]

* SAUCE: usb: ehci: make HC see up-to-date qh/qtd descriptor ASAP
  - LP: #709245

[ Upstream Kernel Changes ]

* cifs: fix possible memory corruption in CIFSFindNext, CVE-2011-3191
  - LP: #834135
  - CVE-2011-3191
* befs: Validate length of long symbolic links, CVE-2011-2928
  - LP: #834124
  - CVE-2011-2928
* gro: Only reset frag0 when skb can be pulled, CVE-2011-2723
  - LP: #844371
  - CVE-2011-2723
* Validate size of EFI GUID partition entries, CVE-2011-1776
  - LP: #844365
  - CVE-2011-1776
* inet_diag: fix inet_diag_bc_audit(), CVE-2011-2213
  - LP: #838421
  - CVE-2011-2213
* si4713-i2c: avoid potential buffer overflow on si4713, CVE-2011-2700
  - LP: #844370
  - CVE-2011-2700
* Bluetooth: Prevent buffer overflow in l2cap config request,
  CVE-2011-2497
  - LP: #838423
  - CVE-2011-2497
* core: Fix memory leak/corruption on VLAN GRO_DROP, CVE-2011-1576
  - LP: #844361
  - CVE-2011-1576
* crypto: Move md5_transform to lib/md5.c, CVE-2011-3188
  - LP: #834129
  - CVE-2011-3188
* net: Compute protocol sequence numbers and fragment IDs using MD5,
  CVE-2011-3188
  - LP: #834129
  - CVE-2011-3188

Show diffs side-by-side

added added

removed removed

Lines of Context:
2963
2963
 
2964
2964
        /* Reject if config buffer is too small. */
2965
2965
        len = cmd_len - sizeof(*req);
2966
 
        if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
 
2966
        if (len < 0 || l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
2967
2967
                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2968
2968
                                l2cap_build_conf_rsp(sk, rsp,
2969
2969
                                        L2CAP_CONF_REJECT, flags), rsp);