Commit d7e0d19a authored by Dan Rosenberg's avatar Dan Rosenberg Committed by David S. Miller

sctp: prevent reading out-of-bounds memory

Two user-controlled allocations in SCTP are subsequently dereferenced as
sockaddr structs, without checking if the dereferenced struct members fall
beyond the end of the allocated chunk.  There doesn't appear to be any
information leakage here based on how these members are used and
additional checking, but it's still worth fixing.

[akpm@linux-foundation.org: remove unfashionable newlines, fix gmail tab->space conversion]
Signed-off-by: default avatarDan Rosenberg <dan.j.rosenberg@gmail.com>
Acked-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5b7c8406
...@@ -916,6 +916,11 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk, ...@@ -916,6 +916,11 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
/* Walk through the addrs buffer and count the number of addresses. */ /* Walk through the addrs buffer and count the number of addresses. */
addr_buf = kaddrs; addr_buf = kaddrs;
while (walk_size < addrs_size) { while (walk_size < addrs_size) {
if (walk_size + sizeof(sa_family_t) > addrs_size) {
kfree(kaddrs);
return -EINVAL;
}
sa_addr = (struct sockaddr *)addr_buf; sa_addr = (struct sockaddr *)addr_buf;
af = sctp_get_af_specific(sa_addr->sa_family); af = sctp_get_af_specific(sa_addr->sa_family);
...@@ -1002,9 +1007,13 @@ static int __sctp_connect(struct sock* sk, ...@@ -1002,9 +1007,13 @@ static int __sctp_connect(struct sock* sk,
/* Walk through the addrs buffer and count the number of addresses. */ /* Walk through the addrs buffer and count the number of addresses. */
addr_buf = kaddrs; addr_buf = kaddrs;
while (walk_size < addrs_size) { while (walk_size < addrs_size) {
if (walk_size + sizeof(sa_family_t) > addrs_size) {
err = -EINVAL;
goto out_free;
}
sa_addr = (union sctp_addr *)addr_buf; sa_addr = (union sctp_addr *)addr_buf;
af = sctp_get_af_specific(sa_addr->sa.sa_family); af = sctp_get_af_specific(sa_addr->sa.sa_family);
port = ntohs(sa_addr->v4.sin_port);
/* If the address family is not supported or if this address /* If the address family is not supported or if this address
* causes the address buffer to overflow return EINVAL. * causes the address buffer to overflow return EINVAL.
...@@ -1014,6 +1023,8 @@ static int __sctp_connect(struct sock* sk, ...@@ -1014,6 +1023,8 @@ static int __sctp_connect(struct sock* sk,
goto out_free; goto out_free;
} }
port = ntohs(sa_addr->v4.sin_port);
/* Save current address so we can work with it */ /* Save current address so we can work with it */
memcpy(&to, sa_addr, af->sockaddr_len); memcpy(&to, sa_addr, af->sockaddr_len);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment