Perform range check on len in nlmsg_reserveandroid-7.1.1_r58android-7.1.1_r54android-7.1.1_r53android-7.1.1_r51android-7.1.1_r49android-7.1.1_r47android-7.1.1_r46android-7.1.1_r44android-7.1.1_r43android-7.1.1_r41android-7.1.1_r39android-7.1.1_r33android-7.1.1_r32android-7.1.1_r31nougat-mr1.1-releasenougat-mr1-volantis-releasenougat-mr1-flounder-release

Bug: 32342065
Test: Compile
Change-Id: I2ef3d63f0910120721c1448eb7d4d64bcec71009
(cherry picked from commit 438fe14af8e839a9186ba30cddbe81ad2311ed00)

1 files changed, 3 insertions, 0 deletions

diff --git a/lib/msg.c b/lib/msg.c
index 9fe9d541..91b86cbd 100644
--- a/lib/msg.c
+++ b/lib/msg.c
@@ -518,6 +518,9 @@ void *nlmsg_reserve(struct nl_msg *n, size_t len, int pad)
 	size_t nlmsg_len = n->nm_nlh->nlmsg_len;
 	size_t tlen;
 
+	if (len > n->nm_size)
+		return NULL;
+
 	tlen = pad ? ((len + (pad - 1)) & ~(pad - 1)) : len;
 
 	if ((tlen + nlmsg_len) > n->nm_size)