af_rose/x25: Sanity check the maximum user frame size

[net-next-2.6.git] / net / netrom / af_netrom.c

diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 6d9c58ec56ac70193adb3cddcb2ef0968ee1906c..d1c16bbee9326b7f3cbce9421e276310dffa4d2e 100644 (file)
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1086,7 +1086,11 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
 
        SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
 
-       /* Build a packet */
+       /* Build a packet - the conventional user limit is 236 bytes. We can
+          do ludicrously large NetROM frames but must not overflow */
+       if (len > 65536)
+               return -EMSGSIZE;
+
        SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
        size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;