Commit d3dcd4ef authored Jun 19, 2006 by Patrick McHardy Committed by David S. Miller Jun 19, 2006

[NETFILTER]: xt_sctp: fix endless loop caused by 0 chunk length



Fix endless loop in the SCTP match similar to those already fixed in
the SCTP conntrack helper (was CVE-2006-1527).

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 25f42b6a

net/netfilter/xt_sctp.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -62,7 +62,7 @@ match_packet(const struct sk_buff *skb,

		do {
		sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
		if (sch == NULL) {
		if (sch == NULL \|\| sch->length == 0) {
		duprintf("Dropping invalid SCTP packet.\n");
		*hotdrop = 1;
		return 0;