Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d2de0d2 authored by Marcelo Ricardo Leitner's avatar Marcelo Ricardo Leitner Committed by Greg Kroah-Hartman
Browse files

sctp: add param size validation for SCTP_PARAM_SET_PRIMARY 



commit ef6c8d6ccf0c1dccdda092ebe8782777cd7803c9 upstream.

When SCTP handles an INIT chunk, it calls for example:
sctp_sf_do_5_1B_init
  sctp_verify_init
    sctp_verify_param
  sctp_process_init
    sctp_process_param
      handling of SCTP_PARAM_SET_PRIMARY

sctp_verify_init() wasn't doing proper size validation and neither the
later handling, allowing it to work over the chunk itself, possibly being
uninitialized memory.

Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6b536186

net/sctp/sm_make_chunk.c

+10 −3
Original line number Original line Diff line number Diff line
@@ -2155,10 +2155,17 @@ static sctp_ierror_t sctp_verify_param(struct net *net, 
		break;

		break;





	case SCTP_PARAM_SET_PRIMARY:

	case SCTP_PARAM_SET_PRIMARY:

		if (net->sctp.addip_enable)

		if (!net->sctp.addip_enable)

			break;

			goto fallthrough;

			goto fallthrough;





		if (ntohs(param.p->length) < sizeof(struct sctp_addip_param) +

					     sizeof(struct sctp_paramhdr)) {

			sctp_process_inv_paramlength(asoc, param.p,

						     chunk, err_chunk);

			retval = SCTP_IERROR_ABORT;

		}

		break;



	case SCTP_PARAM_HOST_NAME_ADDRESS:

	case SCTP_PARAM_HOST_NAME_ADDRESS:

		/* Tell the peer, we won't support this param.  */

		/* Tell the peer, we won't support this param.  */

		sctp_process_hn_param(asoc, param, chunk, err_chunk);

		sctp_process_hn_param(asoc, param, chunk, err_chunk);