]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: validate chunk size in __rcv_asconf_lookup
authorMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Mon, 28 Jun 2021 19:13:43 +0000 (16:13 -0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 26 Sep 2021 12:07:07 +0000 (14:07 +0200)
commit922052fe07f98a7c606da76862089d3c3e74d0ad
tree8bcd75a444aef9d50419eab752a5223d943f96c4
parent474a6ea0e3a72c07215bc6f0b9752fbc1fcd9a84
sctp: validate chunk size in __rcv_asconf_lookup

commit b6ffe7671b24689c09faa5675dd58f93758a97ae upstream.

In one of the fallbacks that SCTP has for identifying an association for an
incoming packet, it looks for AddIp chunk (from ASCONF) and take a peek.
Thing is, at this stage nothing was validating that the chunk actually had
enough content for that, allowing the peek to happen over uninitialized
memory.

Similar check already exists in actual asconf handling in
sctp_verify_asconf().

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sctp/input.c