drbd: Ensure that data_size is not 0 before using data_size-1 as index
This could be exploited by a peer which runs modified code. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com> Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
This commit is contained in:
parent
197296ffed
commit
5de738272e
|
@ -2837,10 +2837,10 @@ static int receive_SyncParam(struct drbd_conf *mdev, enum drbd_packets cmd, unsi
|
|||
|
||||
if (apv >= 88) {
|
||||
if (apv == 88) {
|
||||
if (data_size > SHARED_SECRET_MAX) {
|
||||
dev_err(DEV, "verify-alg too long, "
|
||||
"peer wants %u, accepting only %u byte\n",
|
||||
data_size, SHARED_SECRET_MAX);
|
||||
if (data_size > SHARED_SECRET_MAX || data_size == 0) {
|
||||
dev_err(DEV, "verify-alg of wrong size, "
|
||||
"peer wants %u, accepting only up to %u byte\n",
|
||||
data_size, SHARED_SECRET_MAX);
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue