Subject: Re: xfrm: Fix initialize repl field of struct xfrm_state

From: Steffen Klassert <[email-masked]>
Date: Tue, 22 Mar 2011 14:14:14 +0100

On Tue, Mar 22, 2011 at 09:04:38AM +0800, Wei Yongjun wrote:
> 
> BTW, looking into more about this, another path, XFRM_MSG_NEWAE,
> can overwrite the x->replay_esn with the nla_data length, which
> may larger then the size we malloc.
> 

Yes, I've noticed that yesterday too. I'll fix it up.

Thanks!