From: Eric Paris <eparis@redhat.com>
Subject: [PATCH RHEL5] Netlabel: BZ 221648 fix off by one and initialization bug in netlbl_cipsov4_add_common
Date: Fri, 05 Jan 2007 17:34:43 -0500
Bugzilla: 221648
Message-Id: <1168036483.3339.88.camel@localhost.localdomain>
Changelog: Netlabel: off by one and init bug in netlbl_cipsov4_add_common


BZ 221648

http://marc.theaimsgroup.com/?l=linux-netdev&m=116802828212870&w=2

(explanation stolen from upstream)

The current netlbl_cipsov4_add_common() function has two problems which
are fixed with this patch.  The first is an off-by-one bug where it is
possible to overflow the doi_def->tags[] array.  The second is a bug
where the same  doi_def->tags[] array was not always fully initialized,
which caused sporadic failures.

--- linux-2.6.18.i686/net/netlabel/netlabel_cipso_v4.c.pre.netlabel.one
+++ linux-2.6.18.i686/net/netlabel/netlabel_cipso_v4.c
@@ -130,12 +130,12 @@ static int netlbl_cipsov4_add_common(str
 
 	nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
 		if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
-			if (iter > CIPSO_V4_TAG_MAXCNT)
+			if (iter >= CIPSO_V4_TAG_MAXCNT)
 				return -EINVAL;
 			doi_def->tags[iter++] = nla_get_u8(nla);
 		}
-	if (iter < CIPSO_V4_TAG_MAXCNT)
-		doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
+	while (iter < CIPSO_V4_TAG_MAXCNT)
+		doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
 
 	return 0;
 }