lkml.org 
[lkml]   [2008]   [Jun]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 3/5] sctp: Make sure N * sizeof(union sctp_addr) does not overflow.
    2.6.25-stable review patch.  If anyone has any objections, please let us
    know.

    ------------------
    From: David S. Miller <davem@davemloft.net>

    commit 735ce972fbc8a65fb17788debd7bbe7b4383cc62 upstream

    As noticed by Gabriel Campana, the kmalloc() length arg
    passed in by sctp_getsockopt_local_addrs_old() can overflow
    if ->addr_num is large enough.

    Therefore, enforce an appropriate limit.

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/sctp/socket.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/net/sctp/socket.c
    +++ b/net/sctp/socket.c
    @@ -4421,7 +4421,9 @@ static int sctp_getsockopt_local_addrs_o
    if (copy_from_user(&getaddrs, optval, len))
    return -EFAULT;

    - if (getaddrs.addr_num <= 0) return -EINVAL;
    + if (getaddrs.addr_num <= 0 ||
    + getaddrs.addr_num >= (INT_MAX / sizeof(union sctp_addr)))
    + return -EINVAL;
    /*
    * For UDP-style sockets, id specifies the association to query.
    * If the id field is set to the value '0' then the locally bound
    --


    \
     
     \ /
      Last update: 2008-06-22 21:09    [W:0.022 / U:29.432 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site