Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 232cb53a authored by Lance Richardson's avatar Lance Richardson Committed by David S. Miller
Browse files

sctp: fix overrun in sctp_diag_dump_one() 



The function sctp_diag_dump_one() currently performs a memcpy()
of 64 bytes from a 16 byte field into another 16 byte field. Fix
by using correct size, use sizeof to obtain correct size instead
of using a hard-coded constant.

Fixes: 8f840e47 ("sctp: add the sctp_diag.c file")
Signed-off-by: default avatarLance Richardson <lrichard@redhat.com>
Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a8184003

net/sctp/sctp_diag.c

+4 −2
Original line number Diff line number Diff line
@@ -424,11 +424,13 @@ static int sctp_diag_dump_one(struct sk_buff *in_skb, 
		paddr.v4.sin_family = AF_INET;

	} else {

		laddr.v6.sin6_port = req->id.idiag_sport;

		memcpy(&laddr.v6.sin6_addr, req->id.idiag_src, 64);

		memcpy(&laddr.v6.sin6_addr, req->id.idiag_src,

		       sizeof(laddr.v6.sin6_addr));

		laddr.v6.sin6_family = AF_INET6;



		paddr.v6.sin6_port = req->id.idiag_dport;

		memcpy(&paddr.v6.sin6_addr, req->id.idiag_dst, 64);

		memcpy(&paddr.v6.sin6_addr, req->id.idiag_dst,

		       sizeof(paddr.v6.sin6_addr));

		paddr.v6.sin6_family = AF_INET6;

	}