--- net/rose/rose_subr.c

+++ net/rose/rose_subr.c

@@ -289,10 +289,15 @@ static int rose_parse_national(unsigned

facilities->source_ndigis = 0;

facilities->dest_ndigis = 0;

for (pt = p + 2, lg = 0 ; lg < l ; pt += AX25_ADDR_LEN, lg += AX25_ADDR_LEN) {

- if (pt[6] & AX25_HBIT)

+ if (pt[6] & AX25_HBIT) {

+ if (facilities->dest_ndigis >= ROSE_MAX_DIGIS)

+ return -1;

memcpy(&facilities->dest_digis[facilities->dest_ndigis++], pt, AX25_ADDR_LEN);

- else

+ } else {

+ if (facilities->source_ndigis >= ROSE_MAX_DIGIS)

+ return -1;

memcpy(&facilities->source_digis[facilities->source_ndigis++], pt, AX25_ADDR_LEN);

+ }

}

}

p += l + 2;

@@ -332,6 +337,11 @@ static int rose_parse_ccitt(unsigned cha

case 0xC0:

l = p[1];

+

+ /* Prevent overflows*/

+ if (l < 10 || l > 20)

+ return -1;

+

if (*p == FAC_CCITT_DEST_NSAP) {

memcpy(&facilities->source_addr, p + 7, ROSE_ADDR_LEN);

memcpy(callsign, p + 12, l - 10);

@@ -372,12 +382,16 @@ int rose_parse_facilities(unsigned char

switch (*p) {

case FAC_NATIONAL: /* National */

len = rose_parse_national(p + 1, facilities, facilities_len - 1);

+ if (len < 0)

+ return 0;

facilities_len -= len + 1;

p += len + 1;

break;

case FAC_CCITT: /* CCITT */

len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);

+ if (len < 0)

+ return 0;

facilities_len -= len + 1;

p += len + 1;

break;