Commit a2948659 authored May 06, 2011 by Dan Rosenberg Committed by David S. Miller May 06, 2011

dccp: handle invalid feature options length



A length of zero (after subtracting two for the type and len fields) for
the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to
the subtraction.  The subsequent code may read past the end of the
options value buffer when parsing.  I'm unsure of what the consequences
of this might be, but it's probably not good.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 87e9af6c

net/dccp/options.c

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -123,6 +123,8 @@ int dccp_parse_options(struct sock sk, struct dccp_request_sock dreq,
	case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:		case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:
	if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */		if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */
	break;		break;
			if (len == 0)
			goto out_invalid_option;
	rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,		rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,
	*value, value + 1, len - 1);		*value, value + 1, len - 1);
	if (rc)		if (rc)