ax25: avoid overflows in ax25_setsockopt()

[linux.git] / net / llc / llc_s_ac.c

diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c
index ac3d93b210d2c48b8306d1a593d0fbe0cdaab69e..a94bd56bcac6f74110a0f231814fb45f4a600f30 100644 (file)
--- a/net/llc/llc_s_ac.c
+++ b/net/llc/llc_s_ac.c
@@ -103,7 +103,8 @@ int llc_sap_action_send_xid_r(struct llc_sap *sap, struct sk_buff *skb)
        llc_pdu_decode_sa(skb, mac_da);
        llc_pdu_decode_da(skb, mac_sa);
        llc_pdu_decode_ssap(skb, &dsap);
-       nskb = llc_alloc_frame(NULL, skb->dev);
+       nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U,
+                              sizeof(struct llc_xid_info));
        if (!nskb)
                goto out;
        llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap, dsap,
@@ -144,11 +145,15 @@ int llc_sap_action_send_test_r(struct llc_sap *sap, struct sk_buff *skb)
        u8 mac_da[ETH_ALEN], mac_sa[ETH_ALEN], dsap;
        struct sk_buff *nskb;
        int rc = 1;
+       u32 data_size;
 
        llc_pdu_decode_sa(skb, mac_da);
        llc_pdu_decode_da(skb, mac_sa);
        llc_pdu_decode_ssap(skb, &dsap);
-       nskb = llc_alloc_frame(NULL, skb->dev);
+
+       /* The test request command is type U (llc_len = 3) */
+       data_size = ntohs(eth_hdr(skb)->h_proto) - 3;
+       nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U, data_size);
        if (!nskb)
                goto out;
        llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap, dsap,