1 files changed, 8 insertions, 0 deletions

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 94bf810ad242..6482b001f19a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -401,6 +401,11 @@ static int verify_address_len(const void *p)
 #endif
         int len;
 
+        if (sp->sadb_address_len <
+            DIV_ROUND_UP(sizeof(*sp) + offsetofend(typeof(*addr), sa_family),
+                         sizeof(uint64_t)))
+                return -EINVAL;
+
         switch (addr->sa_family) {
         case AF_INET:
                 len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin), sizeof(uint64_t));
@@ -511,6 +516,9 @@ static int parse_exthdrs(struct sk_buff *skb, const struct sadb_msg *hdr, void *
                 uint16_t ext_type;
                 int ext_len;
 
+                if (len < sizeof(*ehdr))
+                        return -EINVAL;
+
                 ext_len  = ehdr->sadb_ext_len;
                 ext_len *= sizeof(uint64_t);
                 ext_type = ehdr->sadb_ext_type;