From: Philipp Reisner <philipp.reisner@linbit.com>
Date: Fri, 6 Apr 2012 10:08:51 +0000 (+0200)
Subject: drbd: Ensure that data_size is not 0 before using data_size-1 as index
X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=e4bad1bcacd82b3d7727e30db26be3580bdc722a;p=deliverable%2Flinux.git

drbd: Ensure that data_size is not 0 before using data_size-1 as index

This could be exploited by a peer which runs modified code.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
---

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 7b690342efa6..349bd51773e5 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -3344,10 +3344,10 @@ static int receive_SyncParam(struct drbd_tconn *tconn, struct packet_info *pi)
 
 	if (apv >= 88) {
 		if (apv == 88) {
-			if (data_size > SHARED_SECRET_MAX) {
-				dev_err(DEV, "verify-alg too long, "
-				    "peer wants %u, accepting only %u byte\n",
-						data_size, SHARED_SECRET_MAX);
+			if (data_size > SHARED_SECRET_MAX || data_size == 0) {
+				dev_err(DEV, "verify-alg of wrong size, "
+					"peer wants %u, accepting only up to %u byte\n",
+					data_size, SHARED_SECRET_MAX);
 				err = -EIO;
 				goto reconnect;
 			}