]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
authorMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Mon, 28 Jun 2021 19:13:44 +0000 (16:13 -0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 26 Sep 2021 12:07:07 +0000 (14:07 +0200)
commit584e6235ba57ccd89ac6e8a31cdb0213085400e2
treeffff7cee100e8e36e4262c19161d83ecd4c8518b
parent922052fe07f98a7c606da76862089d3c3e74d0ad
sctp: add param size validation for SCTP_PARAM_SET_PRIMARY

commit ef6c8d6ccf0c1dccdda092ebe8782777cd7803c9 upstream.

When SCTP handles an INIT chunk, it calls for example:
sctp_sf_do_5_1B_init
  sctp_verify_init
    sctp_verify_param
  sctp_process_init
    sctp_process_param
      handling of SCTP_PARAM_SET_PRIMARY

sctp_verify_init() wasn't doing proper size validation and neither the
later handling, allowing it to work over the chunk itself, possibly being
uninitialized memory.

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sctp/sm_make_chunk.c