]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: validate chunk size in __rcv_asconf_lookup
authorMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Mon, 28 Jun 2021 19:13:43 +0000 (16:13 -0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 26 Sep 2021 12:07:07 +0000 (14:07 +0200)
commit5e64b42ab04835b7a88a80135af1c44bd8cc8472
tree8bcd75a444aef9d50419eab752a5223d943f96c4
parent9f46b7a8b72716179fd8e1c461e9e027884b49a3
sctp: validate chunk size in __rcv_asconf_lookup

commit b6ffe7671b24689c09faa5675dd58f93758a97ae upstream.

In one of the fallbacks that SCTP has for identifying an association for an
incoming packet, it looks for AddIp chunk (from ASCONF) and take a peek.
Thing is, at this stage nothing was validating that the chunk actually had
enough content for that, allowing the peek to happen over uninitialized
memory.

Similar check already exists in actual asconf handling in
sctp_verify_asconf().

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sctp/input.c