lkml.org 
[lkml]   [2011]   [May]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[19/71] dccp: handle invalid feature options length
    2.6.38-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Dan Rosenberg <drosenberg@vsecurity.com>

    commit a294865978b701e4d0d90135672749531b9a900d upstream.

    A length of zero (after subtracting two for the type and len fields) for
    the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to
    the subtraction. The subsequent code may read past the end of the
    options value buffer when parsing. I'm unsure of what the consequences
    of this might be, but it's probably not good.

    Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
    Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/dccp/options.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/net/dccp/options.c
    +++ b/net/dccp/options.c
    @@ -123,6 +123,8 @@ int dccp_parse_options(struct sock *sk,
    case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:
    if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */
    break;
    + if (len == 0)
    + goto out_invalid_option;
    rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,
    *value, value + 1, len - 1);
    if (rc)



    \
     
     \ /
      Last update: 2011-05-19 20:25    [W:0.031 / U:5.752 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site