Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d9724055 authored by Vlad Yasevich's avatar Vlad Yasevich Committed by David S. Miller
Browse files

sctp: fix random memory dereference with SCTP_HMAC_IDENT option. 



The number of identifiers needs to be checked against the option
length.  Also, the identifier index provided needs to be verified
to make sure that it doesn't exceed the bounds of the array.

Signed-off-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 328fc47e

net/sctp/auth.c

+3 −0
Original line number Diff line number Diff line
@@ -786,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep, 
	for (i = 0; i < hmacs->shmac_num_idents; i++) {

		id = hmacs->shmac_idents[i];



		if (id > SCTP_AUTH_HMAC_ID_MAX)

			return -EOPNOTSUPP;



		if (SCTP_AUTH_HMAC_ID_SHA1 == id)

			has_sha1 = 1;

net/sctp/socket.c

+4 −2
Original line number Diff line number Diff line
@@ -3086,6 +3086,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, 
				    int optlen)

{

	struct sctp_hmacalgo *hmacs;

	u32 idents;

	int err;



	if (!sctp_auth_enable)
@@ -3103,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, 
		goto out;

	}



	if (hmacs->shmac_num_idents == 0 ||

	    hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) {

	idents = hmacs->shmac_num_idents;

	if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||

	    (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {

		err = -EINVAL;

		goto out;

	}