From: Ben Hutchings <ben@xxxxxxxxxxxxxxx> Date: Sun, 1 Nov 2015 16:22:53 +0000 > Currently slhc_init() treats out-of-range values of rslots and tslots > as equivalent to 0, except that if tslots is too large it will > dereference a null pointer (CVE-2015-7799). > > Add a range-check at the top of the function and make it return an > ERR_PTR() on error instead of NULL. Change the callers accordingly. > > Compile-tested only. > > Reported-by: 郭永刚 <guoyonggang@xxxxxx> > References: http://article.gmane.org/gmane.comp.security.oss.general/17908 > Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx> Applied. ��.n��������+%������w��{.n�����{���i�)�� jg��� �����ݢj����G���� ���j:+v���w�m������w�������h�����٥
