• Dan Rosenberg's avatar
    sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac() · 51e97a12
    Dan Rosenberg authored
    The sctp_asoc_get_hmac() function iterates through a peer's hmac_ids
    array and attempts to ensure that only a supported hmac entry is
    returned.  The current code fails to do this properly - if the last id
    in the array is out of range (greater than SCTP_AUTH_HMAC_ID_MAX), the
    id integer remains set after exiting the loop, and the address of an
    out-of-bounds entry will be returned and subsequently used in the parent
    function, causing potentially ugly memory corruption.  This patch resets
    the id integer to 0 on encountering an invalid id so that NULL will be
    returned after finishing the loop if no valid ids are found.
    Signed-off-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
    Acked-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    51e97a12
auth.c 23.9 KB