⬢ DragonFlyBSD Kernel Audit
DF-0498 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
diff --git a/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c b/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c
--- a/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c
+++ b/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c
@@ -1073,6 +1073,10 @@
 			error = EINVAL;
 			break;
 		}
+		if (p->info_size > NG_L2CAP_MAX_ECHO_SIZE) {
+			error = EINVAL;
+			break;
+		}
 
 		NG_MKMESSAGE(ngmsg, NGM_L2CAP_COOKIE,
 			NGM_L2CAP_L2CA_GET_INFO, sizeof(*ip) + p->info_size,