af_rose/x25: Sanity check the maximum user frame size

[linux-2.6-omap-h63xx.git] / net / rose / af_rose.c

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 6501396265819eec021f89eade0f4f7e1551bdfe..0f36e8d59b29c563bfae1f6421c9d5d2a5ddeb44 100644 (file)
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1124,6 +1124,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
 
        /* Build a packet */
        SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
+       /* Sanity check the packet size */
+       if (len > 65535)
+               return -EMSGSIZE;
+
        size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
 
        if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)