]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: prevent reading out-of-bounds memory
authorDan Rosenberg <dan.j.rosenberg@gmail.com>
Fri, 1 Oct 2010 11:16:58 +0000 (11:16 +0000)
committerDavid S. Miller <davem@davemloft.net>
Mon, 4 Oct 2010 04:58:48 +0000 (21:58 -0700)
commit2600c8b8a647b7d89bbc37c550becb1a7dd91ca9
tree3abc10f8a6e3f296fb619077af5f6f16713c62b8
parente4ce58fac39cf5ff239ce9a842822d728c320e25
sctp: prevent reading out-of-bounds memory

Two user-controlled allocations in SCTP are subsequently dereferenced as
sockaddr structs, without checking if the dereferenced struct members fall
beyond the end of the allocated chunk.  There doesn't appear to be any
information leakage here based on how these members are used and
additional checking, but it's still worth fixing.

[akpm@linux-foundation.org: remove unfashionable newlines, fix gmail tab->space conversion]
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sctp/socket.c