[SCTP]: Validate the parameter length in HB-ACK chunk. (CVE-2006-1857)
Linux Kernel Mailing List <[email protected]> Tue, 20 Jun 2006 14:59:01 GMT
| Newsgroups | gmane.linux.kernel.commits.2-4 |
|---|---|
| Message-ID | <[email protected]> |
commit 478afbe1b9b1c3c6f2ddadac6876e1479d792758 tree e11513b7426d3b4426068b15cae42c587ebbc3ea parent 1e5c3464495dc22d706bc1fc04293956357b47f6 author Vlad Yasevich <[email protected]> Tue, 20 Jun 2006 12:56:37 -0700 committer David S. Miller <[email protected]> Tue, 20 Jun 2006 12:56:37 -0700 [SCTP]: Validate the parameter length in HB-ACK chunk. (CVE-2006-1857) If SCTP receives a badly formatted HB-ACK chunk, it is possible that we may access invalid memory and potentially have a buffer overflow. We should really make sure that the chunk format is what we expect, before attempting to touch the data. Signed-off-by: Vlad Yasevich <[email protected]> Signed-off-by: Sridhar Samudrala <[email protected]> Signed-off-by: David S. Miller <[email protected]> net/sctp/sm_statefuns.c | 6 ++++++ 1 files changed, 6 insertions(+) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index b5ce4fb..542f375 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -1014,6 +1014,12 @@ sctp_disposition_t sctp_sf_backbeat_8_3( commands); hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data; + /* Make sure that the length of the parameter is what we expect */ + if (ntohs(hbinfo->param_hdr.length) != + sizeof(sctp_sender_hb_info_t)) { + return SCTP_DISPOSITION_DISCARD; + } + from_addr = hbinfo->daddr; link = sctp_assoc_lookup_paddr(asoc, &from_addr);