From: Ben Hutchings <[email protected]> Date: Sun, 1 Nov 2015 16:22:53 +0000
> Currently slhc_init() treats out-of-range values of rslots and tslots > as equivalent to 0, except that if tslots is too large it will > dereference a null pointer (CVE-2015-7799). > > Add a range-check at the top of the function and make it return an > ERR_PTR() on error instead of NULL. Change the callers accordingly. > > Compile-tested only. > > Reported-by: 郭永刚 <[email protected]> > References: http://article.gmane.org/gmane.comp.security.oss.general/17908 > Signed-off-by: Ben Hutchings <[email protected]> Applied.
