From 42cad45632dcf4b148ecb828ad5670e15fe3045e Mon Sep 17 00:00:00 2001 From: Matthew Daley Date: Fri, 14 Oct 2011 18:45:03 +0000 Subject: [PATCH] x25: Validate incoming call user data lengths X.25 call user data is being copied in its entirety from incoming messages without consideration to the size of the destination buffers, leading to possible buffer overflows. Validate incoming call user data lengths before these copies are performed. It appears this issue was noticed some time ago, however nothing seemed to come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and commit f5bae31825232fa8783d8ab02bca5da21a17a0b4. Signed-off-by: Matthew Daley Acked-by: Eric Dumazet Tested-by: Andrew Hendry Cc: stable Signed-off-by: David S. Miller --- net/x25/af_x25.c | 6 ++++++ net/x25/x25_in.c | 3 +++ 2 files changed, 9 insertions(+) diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c index d30615419b4d7..a4bd1720e39b9 100644 --- a/net/x25/af_x25.c +++ b/net/x25/af_x25.c @@ -958,6 +958,12 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb, goto out_clear_request; skb_pull(skb,len); + /* + * Ensure that the amount of call user data is valid. + */ + if (skb->len > X25_MAX_CUD_LEN) + goto out_clear_request; + /* * Find a listener for the particular address/cud pair. */ diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c index 0b073b51b183a..63488fd4885a7 100644 --- a/net/x25/x25_in.c +++ b/net/x25/x25_in.c @@ -127,6 +127,9 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp * Copy any Call User Data. */ if (skb->len > 0) { + if (skb->len > X25_MAX_CUD_LEN) + goto out_clear; + skb_copy_from_linear_data(skb, x25->calluserdata.cuddata, skb->len); -- 2.39.5