]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: validate chunk size in __rcv_asconf_lookup
authorMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Mon, 28 Jun 2021 19:13:43 +0000 (16:13 -0300)
committerDavid S. Miller <davem@davemloft.net>
Mon, 28 Jun 2021 22:34:50 +0000 (15:34 -0700)
commit20fb26d21404fc8bc06551112c20d69a5f2cf07a
tree8e4a9acc78883f45e75b57cb59e74c8f80e5e653
parent947a582ff5aef2cb10d35ec85ac4abb9c09c2a9b
sctp: validate chunk size in __rcv_asconf_lookup

In one of the fallbacks that SCTP has for identifying an association for an
incoming packet, it looks for AddIp chunk (from ASCONF) and take a peek.
Thing is, at this stage nothing was validating that the chunk actually had
enough content for that, allowing the peek to happen over uninitialized
memory.

Similar check already exists in actual asconf handling in
sctp_verify_asconf().

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sctp/input.c